Traceable ring-type collaborative signature method and device and electronic equipment

Abstract

The invention provides a traceable ring-type collaborative signature method and device and electronic equipment, and relates to the technical field of digital signatures. The method comprises the following steps: acquiring a system public parameter, a tracer public key, a user public key ring structure and a to-be-signed message; generating a binary string random vector of each binary bit according to the binary position index of the target signer in the ring structure; according to a tracer basic matrix, the binary string random vector of each binary bit and a tracer public key in the system public parameters, encrypting each binary bit to generate encrypted index information; according to the system public parameters, the tracer public key, the ring structure, the encrypted index information, the private key of the target signer, the binary position index, the binary string random vector and the to-be-signed message, a zero-knowledge proof generation algorithm is adopted to generate proof information; and generating a ring signature according to the encrypted index information and the proof information. According to the method, the ring signature capable of tracing the signer can be generated, and malicious signature is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital signature, in particular to a traceable ring collaborative signature method, device and electronic equipment. BACKGROUND

[0002] With the evolution of cryptography from classical cryptography to modern public key cryptography, digital signature, as a core component, provides a fundamental guarantee for the integrity, authenticity and non-repudiation of electronic data.

[0003] With the popularity of multi-party collaboration scenarios, collaborative signature technology emerges as the times require, allowing multiple participants to jointly generate a signature to express the group's will. As a special form of collaborative signature, ring signature allows users to generate a signature anonymously using a set of pre-set member public keys (i.e. "ring"), hiding the actual signer's identity from the outside, and has important value in privacy protection voting, anonymous identity authentication and other scenarios.

[0004] However, traditional ring signature overemphasizes anonymity and lacks a traceability mechanism for malicious signers. Once a denial of service or abuse occurs, it is difficult to locate the responsible person through the signature itself, making it difficult to meet regulatory requirements. SUMMARY

[0005] The purpose of the present application is to provide a traceable ring collaborative signature method, device and electronic equipment to generate a ring signature that can trace the signer and avoid malicious signing.

[0006] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows: In a first aspect, the embodiments of the present application provide a traceable ring collaborative signature method, which comprises: obtaining system public parameters, a tracer public key, a ring structure composed of multiple user public keys, and a message to be signed; generating a binary string random vector of each binary bit of the binary position index according to the binary position index of the target signer in the ring structure; encrypting each binary bit according to the tracer base matrix in the system public parameters, the binary string random vector of each binary bit, and the tracer public key, to generate encrypted index information; generating proof information using a zero-knowledge proof generation algorithm according to the system public parameters, the tracer public key, the ring structure, the encrypted index information, the private key of the target signer, the binary position index, the binary string random vector, and the message to be signed; According to the encrypted index information and the proof information, a ring signature is generated, wherein a tracer is used to trace and authenticate the ring signature by a tracer private key.

[0007] Optionally, the step of obtaining the tracer public key comprises: randomly sampling a short matrix and an error matrix from a discrete Gaussian distribution matrix; using the short matrix as a tracer private key; generating the tracer public key according to the tracer base matrix, the error matrix and the short matrix.

[0008] Optionally, the step of generating the user public key comprises: randomly sampling a short vector from a discrete Gaussian distribution vector as a user private key of each user; generating a user public key of each user according to a user public key matrix in the system public parameter and the short vector.

[0009] Optionally, the step of encrypting each binary bit according to the tracer base matrix in the system public parameter, the binary string random vector of each binary bit and the tracer public key to generate encrypted index information comprises: generating a first encrypted index component of each binary bit according to the tracer base matrix and the binary string random vector of each binary bit; encrypting each binary bit according to the tracer public key and the binary string random vector of each binary bit to generate a second encrypted index component of each binary bit; generating the encrypted index information according to the first encrypted index component and the second encrypted index component of a plurality of binary bits in the binary position index.

[0010] Optionally, after the step of generating a ring signature according to the encrypted index information and the proof information, the method further comprises: constructing a challenge value by using a preset hash function according to the system public parameter, the tracer public key, the ring structure, the encrypted index information and the message to be signed; verifying the validity of the ring signature by using a zero-knowledge proof verification algorithm according to the challenge value and the proof information.

[0011] Optionally, the method further comprises: validating the ring signature; if the ring signature is a valid signature, decrypting the encrypted index information according to the tracer private key to determine a target position index of the target signer; determining a target user public key of the target signer in the ring structure according to the target position index; generating a traceability proof according to the traceability public key, the ring signature and the target user public key, the traceability proof indicating that a decryption process is correct and the target user public key is the user public key of the target signer.

[0012] Optionally, the decrypting the encrypted index information according to the traceability private key, and determining the target position index of the target signer, comprises: decrypting the encrypted index information according to the traceability private key, and generating the noise decryption result of each binary bit; generating the reconstruction result of each binary bit according to a comparison result of the noise decryption result of each binary bit and a preset threshold; determining the target position index according to the reconstruction results of multiple binary bits.

[0013] Optionally, the method further comprises: validating the ring signature and the traceability proof; if the ring signature and the traceability proof are both valid, determining that a traceability result is correct.

[0014] In a second aspect, the embodiments of the present application further provide a traceable ring collaborative signature device, the device comprising: an information acquisition module, configured to acquire a system public parameter, a traceability public key, a ring structure composed of multiple user public keys, and a message to be signed; a random vector generation module, configured to generate a binary string random vector of each binary bit of a binary position index of a target signer in the ring structure according to the binary position index; an information encryption module, configured to encrypt each binary bit according to a traceability base matrix in the system public parameter, the binary string random vector of each binary bit and the traceability public key, and generate encrypted index information; a proof information generation module, configured to generate proof information by using a zero-knowledge proof generation algorithm according to the system public parameter, the traceability public key, the ring structure, the encrypted index information, a private key of the target signer, the binary position index, the binary string random vector and the message to be signed; a ring signature generation module, configured to generate a ring signature according to the encrypted index information and the proof information, wherein a traceability person is used to perform traceability authentication on the ring signature by using a traceability private key.

[0015] Optionally, the information obtaining module is specifically configured to: randomly sample a short matrix and an error matrix from a discrete Gaussian distribution matrix; take the short matrix as a tracer private key; and generate a tracer public key according to the tracer base matrix, the error matrix and the short matrix.

[0016] Optionally, the information obtaining module is further configured to: randomly sample a short vector from a discrete Gaussian distribution vector as a user private key of each user; and generate a user public key of each user according to a user public key matrix in the system public parameter and the short vector.

[0017] Optionally, the information encryption module is specifically configured to: generate a first encryption index component of each binary bit according to the tracer base matrix and a binary string random vector of each binary bit; encrypt each binary bit according to the tracer public key and the binary string random vector of each binary bit to generate a second encryption index component of each binary bit; and generate the encryption index information according to the first encryption index components and the second encryption index components of the plurality of binary bits in the binary position index.

[0018] Optionally, the apparatus further comprises: The validity verification module is configured to: construct a challenge value by using a preset hash function according to the system public parameter, the tracer public key, the ring structure, the encryption index information and the message to be signed; and verify the validity of the ring signature by using a zero-knowledge proof verification algorithm according to the challenge value and the proof information.

[0019] Optionally, the validity verification module is further configured to verify the validity of the ring signature. The tracing module is configured to: if the ring signature is a valid signature, decrypt the encryption index information according to the tracer private key to determine a target position index of the target signer; determine a target user public key of the target signer in the ring structure according to the target position index; and generate a tracing proof according to the tracer public key, the ring signature and the target user public key, the tracing proof indicating that the decryption process is correct and the target user public key is the user public key of the target signer.

[0020] Optionally, the tracing module is specifically configured to: decrypt the encryption index information according to the tracer private key to generate a noise decryption result of each binary bit; generate a reconstruction result of each binary bit according to a comparison result of the noise decryption result of each binary bit and a preset threshold; and determine the target position index according to the reconstruction results of the plurality of binary bits.

[0021] Optionally, the validity verification module is further configured to verify the validity of the ring signature and the traceability proof, and determine that the traceability result is correct if both the ring signature and the traceability proof are valid.

[0022] In a third aspect, the embodiments of the present application further provide an electronic device, comprising a processor, a storage medium and a bus, the storage medium stores program instructions executable by the processor, when the electronic device is running, the processor and the storage medium communicate through the bus, and the processor executes the program instructions to perform the steps of the traceable ring collaborative signature method according to any one of the first aspect.

[0023] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, the storage medium stores a computer program, and the computer program performs the steps of the traceable ring collaborative signature method according to any one of the first aspect when executed by a processor.

[0024] The beneficial effects of the present application are as follows: The traceable ring collaborative signature method, device and electronic device provided by the present application encrypt each binary bit of the binary position index of the signer by using the traceability public key, the binary string random vector of each binary bit and the traceability base matrix, generate encrypted index information, embed clues for decipherable traceability while protecting the privacy of the signer, so that only the person who has the traceability private key can decrypt the ring signature to trace whether the user who generates the ring signature is a user on the ring structure, ensure the security of the signing user, realize the traceability of the signer, and meet the compliance audit requirements of financial, medical and other scenarios.

[0025] In addition, the process of generating the encrypted index information is proved by the zero-knowledge proof generation method to generate proof information, so that the encrypted index information can be verified by the proof information without revealing the secret of the signer, to further securely authenticate the identity of the signer. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0027] Figure 1 The system model diagram of the traceable ring collaborative signature system provided by the embodiments of the present application; Figure 2 The hierarchical architecture diagram of the traceable ring collaborative signature system provided by the embodiments of the present application; Figure 3 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 1 ; Figure 4 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 2 ; Figure 5 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 3 ; Figure 6 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 4 ; Figure 7 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 5 ; Figure 8 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 6 ; Figure 9 Flowchart of the traceable ring-type collaborative signature method provided for the embodiments of the present application Figure 7 ; Figure 10 Structure diagram of the traceable ring-type collaborative signature device provided for the embodiments of the present application Figure 11 Schematic diagram of the electronic device provided for the embodiments of the present application. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0029] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0030] Moreover, the terms "first", "second", and the like, in the description and in the claims of the present application are used for distinguishing between similar elements and not necessarily for describing a specific sequential or chronological order. It is to be understood that the use of these terms herein is merely for distinguishing between the elements being described and not necessarily for describing a particular chronological order unless explicitly indicated to be such. Furthermore, the terms "comprising", "having", "including", and "containing" or any variation thereof, are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that comprises, has, includes, or contains a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0031] It should be noted that the features of the embodiments of the present application can be combined if there is no conflict.

[0032] In order to better understand the scheme of the present application, the following will first explain the related terms that may be involved in the present application.

[0033] Post-Quantum Cryptography (PQC): Post-Quantum Cryptography is a new type of cryptographic scheme that can resist quantum computing attacks. With the development of quantum computers, classical cryptography systems based on traditional problems such as discrete logarithm and large integer factorization are at risk of being cracked by Shor's algorithm. Post-Quantum Cryptography ensures the security of the cryptographic system in the post-quantum era by constructing encryption and signature protocols based on mathematical problems such as lattice theory, coding theory, multivariate equations, or hash functions. Its core goal is to design algorithms that are provably secure under both classical and quantum computing models, providing long-term security guarantees for future network infrastructure.

[0034] Lattice-Based Cryptography: Lattice-Based Cryptography is a core branch of Post-Quantum Cryptography, whose security relies on the computational complexity of mathematical problems such as the Shortest Vector Problem (SVP) or the Learning with Errors (LWE) problem on lattices. Lattice-Based Cryptography maps keys and ciphertexts to vectors or points in high-dimensional lattice spaces, using the randomness characteristics and noise interference of lattice problems to achieve encryption. Its advantages include flexible construction, strong provable security, and the ability to support multiple functions such as encryption, signature, and homomorphic computation. Since lattice problems have no effective solution under the quantum computing model, Lattice-Based Cryptography has become an important candidate direction for post-quantum cryptography standardization.

[0035] Co-Signature (CS): Co-signature is a cryptographic protocol that allows multiple participants to jointly generate a single digital signature. In the collaboration process, each participant contributes a partial signature fragment to the same message using their own private key, and finally synthesizes a complete group signature. This technology solves the identity binding problem in the multi-party joint authorization scenario, ensures that the signature result cannot be forged and can verify the collective will of all participants, and is suitable for scenarios such as contract joint signature, blockchain multi-signature account, and other distributed decision-making scenarios.

[0036] Ring Signature (RS): Ring signature is a special anonymous co-signature technology. The signer selects several public keys (including their own public key) from a preset member set (called "ring") and generates a signature using these public keys. The verifier can confirm that the signature comes from a member of the ring, but cannot locate the actual signer's identity. Ring signature naturally has "signer ambiguity", which protects privacy while providing group trust certification, and is widely used in privacy-sensitive scenarios such as anonymous voting and cryptocurrency transactions.

[0037] Zero-Knowledge Proof (ZKP): Zero-knowledge proof is an interactive or non-interactive cryptographic protocol that allows the prover to prove the truth of a statement to the verifier without revealing any additional information (such as secret parameters or calculation process). Its core features include completeness (true statements can be verified), reliability (false statements cannot pass) and zero-knowledge (the verification process does not leak information). This technology balances "knowledge proof" and "information hiding" through mathematical methods, providing verifiable computing logic for privacy protection systems.

[0038] Signature of Knowledge (SoK): Signature of Knowledge is a combination of zero-knowledge proof and digital signature, used to prove that the signer possesses certain secret knowledge (such as private key or parameters satisfying certain relationships) and bind the proof to a specific message. Its essence is a digital signature of the fact that "knows a certain secret", and the verifier can confirm that the signer indeed holds the secret, but cannot obtain the secret content itself. This technology provides an efficient knowledge ownership proof mechanism for anonymous credentials, verifiable statements and other scenarios.

[0039] Figure 1 The system model diagram of the traceable ring co-signature system provided by the embodiments of the present application is shown in FIG. 1, which can be composed of a trusted setting party, a traceability party, a verifier and a plurality of co-signature users. Figure 1

[0040] ​Wherein, the trusted setting party, the tracer, the verifier and the plurality of collaborative signature users respectively use computer equipment, servers and other electronic equipment as the execution subject, and the embodiment does not limit this.

[0041] Specifically, the trusted setting party is internally provided with a parameter generator, a random number generator, a security parameter configuration module, a matrix sampling module and a public parameter output interface. The security parameter configuration module is used to generate security parameters (including prime numbers, dimensions and Gaussian distribution parameters) and a hash function based on lattice cryptography technology. The matrix sampling module is used to sample a random matrix. The parameter generator can generate a user public key matrix and a tracer base matrix according to the random matrix. The public parameter output interface is used to send the system public parameters composed of the security parameters, the hash function, the user public key matrix and the tracer base matrix to the verifier and the plurality of collaborative signature users.

[0042] The tracer is internally provided with a key generator, a data decryption interface, a private key management module, an index decryption module, a proof generation module, a public key publishing interface and a traceability proof output interface. The key generator is used to generate a tracer private key and a tracer public key. The private key management module is used to manage the tracer private key. The public key publishing interface is used to publish the tracer public key to the verifier and the plurality of collaborative signature users. The data decryption interface is used to receive a ring signature generated by a target signer in the plurality of collaborative signature users. The index decryption module is used to decrypt encrypted index information in the ring signature. The proof generation module is used to generate a traceability proof for the decryption process. The traceability proof output interface is used to provide the traceability proof to the verifier.

[0043] The verifier is internally provided with a proof verifier, a hash calculator, a signature verification module, a traceability decision module, a verification result output interface and a decision result feedback interface. The signature verification module is used to verify the proof information in the ring signature. The verification result output interface is used to output the verification result. The traceability decision module is used to verify the signature and the traceability proof. The decision result feedback interface is used to generate a decision result. The hash calculator and the proof verifier are used in the verification process.

[0044] The plurality of collaborative signature users are internally provided with a key generation module, a ring constructor, a zero-knowledge proof generator, an encrypted index generation module, a signature synthesis module, a public key exchange interface and a signature submission interface. The key generation module is used to generate a user public key and a user private key. The public key exchange interface is used to exchange the user public keys of the plurality of collaborative signature users. The ring constructor is used to generate a ring structure according to the user public keys of the users. The encrypted index generation module is used to generate encrypted index information. The zero-knowledge proof generator is used to generate proof information. The signature synthesis module is used to generate a ring signature according to the encrypted index information and the proof information, and submit the ring signature to the verifier and the tracer through the signature submission interface.

[0045] Figure 2The hierarchical architecture diagram of the traceable ring-based collaborative signature system provided in the embodiments of this application is as follows: Figure 2 As shown, the traceable ring-based collaborative signature system includes: a basic cryptographic layer, a key management layer, a protocol execution layer, and an application interface layer.

[0046] The basic cryptographic layer includes a lattice parameter generator, a quantum-resistant hashing module, a matrix operation unit, a Gaussian distribution sampling unit, and a parameter initialization interface.

[0047] The key management layer includes a traceable key generator, a user key generator, a short matrix / vector generation module, a public key calculation module, and a key pair output interface.

[0048] The protocol execution layer includes a ring signature interface, a zero-knowledge proof processor, an encryption index generation module, a proof verification logic module, a decryption adjudication module, a signature generation interface, and a verification request interface.

[0049] The application interface layer includes a message input parser, a result output controller, a ring construction interface module, a traceability proof submission module, and an external system interaction interface.

[0050] The following describes the specific implementation of the traceable ring collaborative signature method applied to the traceable ring collaborative signature system, with reference to the embodiments.

[0051] Figure 3 A flowchart illustrating the traceable ring-based collaborative signature method provided in this application embodiment. Figure 1 ,like Figure 3 As shown, the method may include: S101. Obtain system public parameters, tracer public key, ring structure composed of multiple user public keys, and message to be signed.

[0052] In this embodiment, the trusted setter generates system public parameters and provides them to the tracer, verifier, and signer. These system public parameters may include prime numbers. Dimensions Vector length Gaussian discrete distribution parameters User public key matrix Originator Basic Matrix and hash function Trusted settings for source tracers, verifiers, and signers output common system parameters. .

[0053] Source tracer public key The public key generated by the source tracer and the source tracer's private key. The public and private key pairs of the tracer are formed.

[0054] Multiple collaborative signing users each possess their own unique public keys. For each signer among these collaborative signing users, a ring structure is formed by selecting several public keys (including their own) from the public keys of the multiple collaborative signing users. N represents the number of users who collaborate on the signature.

[0055] In some embodiments, the process by which a trusted setter generates system public parameters may include: Get the preset prime number Preset grid dimensions Preset vector length Gaussian distribution parameters From the model of Integer ring Medium sampling random matrix As the user's public key matrix; sampling random matrix As the base matrix for tracing the origin; choosing a hash function. This function is used to map a binary string of arbitrary length to a binary string of length 256 bits. In this embodiment, a quantum-resistant hash function SHA3-256 can be selected.

[0056] Among them, the trusted setter generates quantum-resistant security parameters, and reduces computational complexity through lattice parameter optimization, providing an efficient mathematical foundation for subsequent signature and traceability.

[0057] S102. Based on the binary position index of the target signer in the ring structure, generate a random vector of binary strings for each binary bit of the binary position index.

[0058] In this embodiment, for the target signer among multiple collaborative signer users, the initial position index of the target signer in the ring structure is determined. Convert to binary position index, for the first position in the binary position index bits, sampled generation length is Binary string random vector .

[0059] In some embodiments, the initial position index of the target signer in the ring structure is used. The method for converting to binary position indexes can be: ,in, , If each bit is 0 or 1, the weighted sum is calculated based on the condition that each bit is 0 or 1. The result determines the binary position index.

[0060] S103, encrypt each binary bit according to the tracer public key, the binary string random vector of each binary bit, and the tracer base matrix in the system public parameter, to generate encrypted index information.

[0061] In this embodiment, in order to hide the identity information of the signer, the tracer public key and the binary string random vector of each binary bit are needed to encrypt each binary bit, and at the same time, in order to avoid exposure of the binary string random vector of each binary bit , the binary string random vector of each binary bit also needs to be encrypted using the tracer base matrix to jointly constitute the encrypted index information .

[0062] Only the person who has the tracer private key can decrypt the signature to trace whether the user who performs the signature is a user on the ring structure, thereby ensuring the security of the signature user.

[0063] S104, generating proof information by using a zero-knowledge proof generation algorithm according to the system public parameter, the tracer public key, the ring structure, the encrypted index information, the private key of the target signer, the binary position index, the binary string random vector, and the message to be signed.

[0064] In this embodiment, after the verifier receives the encrypted index information , it cannot determine whether the encrypted index information correctly corresponds to the real user index in the ring structure, whether the signer has the legal private key of the corresponding member, and whether the encryption process complies with the protocol rules, but in order to avoid revealing the identity information of the signer to the verifier, it is necessary to generate proof information to prove to the verifier that the signer is indeed a legal member in the ring structure and has correctly encrypted the position information of itself.

[0065] Specifically, the secret component of the target signer includes: the private key of the target signer , the binary string random vector of multiple binary bits of the binary position index , and the values of multiple binary bits , and the public parameters include: the user public key matrix , the tracer base matrix , the tracer public key , the ring structure , the encrypted index information , and the message to be signed .

[0066] According to the above information, multiple pieces of proof relationship are formed, and the multiple pieces of proof relationship include: proving that one public key belongs to the ring structure and satisfies the relationship between the initial position index and the binary position index. and the user public key matrix The public key can be calculated, proving that for each binary bit, there is a corresponding value that can make the encrypted index information calculation correct, proving that the value of the binary bit that makes the encrypted index information calculation correct is binary, and satisfying the relationship between the initial position index and the binary position index.

[0067] In the actual proof process, a non-interactive challenge is generated through the Fiat-Shamir transformation. Specifically, for each secret component, a random mask is generated, the random masks of multiple cryptographic components are combined to form a commitment value, the public parameter is hashed together with the commitment value to obtain a challenge value, the response mode is determined according to the challenge value, and the response is generated according to the response mode. The commitment value, challenge value and response are packaged to generate proof information .

[0068] It should be noted that the proof information does not directly contain the proof of the plurality of to-be-proved relationships, but provides all the data required for verification. After receiving the proof information , the verifier can complete the verification of the plurality of to-be-proved relationships by re-computing the hash challenge value and checking whether the commitment and the response satisfy the data equation of the response. The process of generating the proof information actually forms a carefully constructed commitment-challenge and response triple, so that any verifier can be sure that the secret component exists and satisfies all the to-be-proved relationships, and the proof process does not leak any secret information.

[0069] For example, the zero-knowledge proof generation algorithm is used to generate the proof information The expression can be expressed as: , wherein is the tracer public key , the corresponding tracer public key matrix is .

[0070] S105, according to the encrypted index information and the proof information, generating a ring signature, wherein the tracer is used to trace and authenticate the ring signature through the tracer private key.

[0071] In this embodiment, the encrypted index information and the proof information are combined to generate a ring signature .

[0072] When the tracer needs to trace and authenticate the ring signature, the encrypted index information can be decrypted through the tracer private key to determine the initial position index, and it is judged whether the initial position index is the position index in the ring structure. If yes, it is determined that the target signer is a secure signer in the ring structure.

[0073] The traceable ring-type collaborative signature method provided by the above embodiment encrypts each binary bit of the binary position index of the signer by using the tracer public key, the binary string random vector of each binary bit, and the tracer base matrix, generates encrypted index information, embeds a clue that can be decrypted for tracing while protecting the privacy of the signer, so that only the person who has the tracer private key can decrypt the ring signature to trace whether the user who generates the ring signature is a user on the ring structure, ensuring the security of the signing user and realizing the tracing of the signer, meeting the compliance audit requirements of financial, medical and other scenarios.

[0074] In addition, the process of generating the encrypted index information is proved by the zero-knowledge proof generation method, and proof information is generated, so that the encrypted index information can be verified by the proof information without revealing the secret of the signer, so as to further safely authenticate the identity of the signer.

[0075] In a possible implementation manner, Figure 4 The flowchart of the traceable ring-type collaborative signature method provided by the embodiments of the present application is shown in Figure 2 As shown in Figure 4 , the process of obtaining the tracer public key in S101 can include: S201, randomly sampling a short matrix and an error matrix from a discrete Gaussian distribution matrix.

[0076] S202, taking the short matrix as the tracer private key.

[0077] S203, generating the tracer public key according to the tracer base matrix, the error matrix and the short matrix.

[0078] In the present embodiment, the tracer randomly samples a short matrix S from a discrete Gaussian distribution matrix , the short matrix S satisfies , and randomly samples an error matrix E from a discrete Gaussian distribution matrix .

[0079] Taking the short matrix S as the tracer private key , that is, , according to the tracer base matrix B, the error matrix E and the short matrix S, the tracer public key matrix T is calculated, , and taking the tracer public key matrix T as the tracer public key , that is, .

[0080] The traceable ring-based collaborative signature method provided in the above embodiments allows the tracer to calculate a quantum-resistant public key matrix by sampling private key matrices that meet the short norm condition and superimposing error matrices, thereby forming a publicly verifiable traceable key system. This ensures that the private key cannot be forged and the public key can be securely published, providing cryptographic protection for index encryption.

[0081] In one possible implementation, Figure 5 A flowchart illustrating the traceable ring-based collaborative signature method provided in this application embodiment. Figure 3 ,like Figure 5 As shown, the step of generating the user public key in S101 above may include: S301. Randomly sample a short vector from the discrete Gaussian distribution vector as the user's private key for each user.

[0082] S302. Generate the user public key for each user based on the user public key matrix and short vector in the system public parameters.

[0083] In this embodiment, each collaborative signature user independently generates a short vector private key, calculates the corresponding public key through the user's public key matrix, and forms the public-private key pair required for signing.

[0084] Specifically, each collaborative signature user starts from a discrete Gaussian distribution vector. Short vectors of random sampling ,satisfy With short vectors The user's private key for each co-signing user Based on the user's public key matrix A and the short vector Calculate the public key of each co-signing user. ,Right now .

[0085] The traceable ring-based collaborative signature method provided in the above embodiments samples a short vector private key, derives the public key through linear operations on the user's public key matrix, constructs a user-level public-private key pair, ensures the security of the private key based on the small integer solution problem on the lattice, and at the same time, the public key computation is lightweight, supporting large-scale user deployment.

[0086] In one possible implementation, Figure 6 A flowchart illustrating the traceable ring-based collaborative signature method provided in this application embodiment. Figure 4 ,like Figure 6 As shown, the process of S103 above, which encrypts each binary bit and generates encrypted index information based on the tracer's basic matrix, the random vector of the binary string for each binary bit, and the tracer's public key in the system's public parameters, may include: S401. Based on the source tracer base matrix and the binary string random vector for each binary bit, generate the first encrypted index component for each binary bit.

[0087] S402、According to the tracer public key and the binary string random vector of each binary bit, encrypt each binary bit to generate a second encrypted index component of each binary bit.

[0088] S403、According to the first encrypted index component and the second encrypted index component of the plurality of binary bits in the binary position index, generate encrypted index information.

[0089] In this embodiment, for each binary bit the binary string random vector , according to the tracer base matrix B, calculate the first encrypted index component , according to the tracer public key and the binary string random vector calculate the second encrypted index component , wherein is the i-th column of the tracer public key matrix T, then the encrypted index information .

[0090] Use zero-knowledge proof generation algorithm to prove the following relationship: knowledge satisfies ; ; ; wherein , and , .

[0091] For the private key corresponding to the short vector x, generate a random short vector y, for the binary string random vector , generate a random vector , for the value of each binary bit, generate a random bit , respectively calculate the corresponding commitment value, that is , , , the commitment value , according to the public parameter and the commitment value, calculate the challenge value , according to the challenge value to determine the response value, if the challenge value indicates "prove the consistency of the mask", the response value is the mask y, and , if the challenge value indicates "prove the secret relationship", the response value is the linear combination of the mask and the corresponding secret, and the proof information .

[0092] The traceable ring collaborative signature method provided by the above embodiment, a signer constructs a public key ring structure, converts an index of the signer into a binary form, and generates ciphertext by encrypting the index bit by bit using a traceable public key; then, validity of a private key, correctness of the ciphertext, and consistency of the index and ring members are verified synchronously through zero-knowledge proof, and finally a signature containing the ciphertext and the proof is output, the index encryption is coupled with the zero-knowledge proof, so that traceable clues are embedded while anonymity is ensured.

[0093] In a possible implementation manner, Figure 7 The flowchart of the traceable ring collaborative signature method provided by the embodiment of the application Figure 5 As shown in Figure 7 , after the ring signature is generated according to the encrypted index information and the proof information in S105, the method can further include: S501, constructing a challenge value using a preset hash function according to a system public parameter, a traceable public key, a ring structure, encrypted index information, and a message to be signed.

[0094] S502, verifying validity of the ring signature using a zero-knowledge proof verification algorithm according to the challenge value and the proof information.

[0095] In this embodiment, after the target signer outputs the collaborative signature, the verifier can construct a challenge value using a hash function, and check validity of the ring signature using a zero-knowledge proof verification algorithm, and if the verification is passed, the ring signature is accepted, otherwise, the ring signature is rejected.

[0096] Specifically, the verifier extracts a commitment value , a challenge value , and a response value from the proof information , obtains encrypted index information , and then the verifier re-computes the challenge value , and judges and whether they are consistent, if not, it is determined that the ring signature verification fails, if consistent, it is determined whether the verification branch is “proof mask consistency” or “proof secret relationship” according to the challenge value, if “proof mask consistency”, corresponding results are calculated according to the mask y and in the response value, and compared with , if “proof secret relationship”, the calculation is performed according to the proof relationship, and compared with , finally, it is determined whether the verification bit constraint is satisfied, and if all verifications are passed, it is determined that the ring signature is valid, and if any verification fails, it is determined that the ring signature is invalid.

[0097] For example, whether the proof information is valid is verified by . is valid, wherein is a zero-knowledge proof verification algorithm based on Fiat-Shamir transformation. If the output result is 1, it is determined that the verification passes, and if the output result is 0, it is determined that the verification fails.

[0098] The traceable ring collaborative signature method provided by the above embodiment can drive the zero-knowledge proof verification algorithm to check the validity of the ring signature by constructing a challenge value through the quantum-resistant hash function, specifically by verifying whether the proof content matches the public key matrix, the ring structure and the ciphertext data, and confirming the binding relationship between the ring signature and the message, without revealing the identity or index plaintext of the signer, thereby achieving efficient and privacy-protected legality verification.

[0099] In a possible implementation manner, Figure 8 The flowchart of the traceable ring collaborative signature method provided by the embodiment of the present application Figure 6 As shown in Figure 8 , the method can further include: S601, verifying the validity of the ring signature.

[0100] In the embodiment, the tracer needs to verify the validity of the ring signature before performing the traceability authentication on the ring signature, and the verification manner is the same as that of the verifier verifying the validity of the ring signature in S501-S502, which will not be described herein.

[0101] The verification expression is: If the verification result is 0, the traceability authentication process is terminated.

[0102] S602, if the ring signature is a valid signature, decrypting the encrypted index information according to the private key of the tracer to determine the target position index of the target signer.

[0103] In the embodiment, in the case where the ring signature is determined to be valid, the tracer decrypts the encrypted index information using the private key of the tracer, and determines the decimal position index, i.e. the target position index of the target signer, according to the binary position index obtained by decryption.

[0104] S603, determining the target user public key of the target signer in the ring structure according to the target position index.

[0105] In the embodiment, according to the target position index, the user public key corresponding to the target position index in the ring structure is determined as the target user public key of the target signer.

[0106] In this way, the tracer can trace the identity information of the signer who is anonymous to the public from the ring signature, so as to trace back when auditing.

[0107] S604, generating a traceability proof according to the traceability person public key, the ring signature and the target user public key, the traceability proof indicating that the decryption process is correct and the target user public key is the target signer's user public key.

[0108] In this embodiment, if only the traceability person can decrypt the signer's identity information, but there is no proof mechanism, the authenticity of the traceability result of the traceability person cannot be determined, therefore, in the traceability process, according to the process of decrypting the binary position index, the process of locating the user public key, some relations to be proved are also generated, and a random mask is generated according to the secret of the traceability person, the commitment value and the challenge value are calculated, and the traceability proof is composed .

[0109] In some embodiments, the process of S602 described above decrypting the encrypted index information according to the traceability person private key to determine the target position index of the target signer can include: decrypting the encrypted index information according to the traceability person private key to generate the noise decryption result of each binary bit; generating the reconstruction result of each binary bit according to the comparison result of the noise decryption result of each binary bit and the preset threshold; and determining the target position index according to the reconstruction results of multiple binary bits.

[0110] In this embodiment, for each binary bit , the noise decryption result is calculated , wherein is the i-th column of the short vector S corresponding to the traceability person public key, if , it is determined that , if , it is determined that . The error tolerance mechanism ensures that the traceability result is reliable in a noisy environment, and improves the robustness of the system in a real network environment.

[0111] According to the reconstruction results of multiple binary bits , the target position index is determined, and the target user public key of the target signer is determined.

[0112] For example, the secret of the traceability person includes the private key corresponding to the short vector S, the decrypted binary position index and the determined target user public key , the relations to be proved can include: private key validity proof relation is a small norm matrix, and the decryption correctness proof . The process of calculating the commitment value, the challenge value and the response value is basically the same as the process of generating the proof information before, and will not be repeated here.

[0113] For example, the traceability proof The expression can be represented as .

[0114] The traceable ring-based collaborative signature method provided in the above embodiments, under the premise that the signature is valid, the tracer uses the private key to decrypt the ciphertext, calculates the decryption value bit by bit and determines the binary index bit, reconstructs the signer index to locate its public key; and simultaneously generates a publicly verifiable traceability proof to confirm that the decryption operation meets the preset error tolerance range. Through the lattice decryption error tolerance mechanism and proof generation technology, the non-repudiation of the traceability result is ensured.

[0115] In one possible implementation, Figure 9 A flowchart illustrating the traceable ring-based collaborative signature method provided in this application embodiment. Figure 7 ,like Figure 9 As shown, the method may further include: S701. Verify the validity of ring signatures and traceability proofs.

[0116] S702. If both the ring signature and the proof of origin are valid, the proof of origin is considered correct.

[0117] In this embodiment, the verifier verifies the tracer's traceability results to determine whether the target user's public key obtained by the tracer is valid. First, the validity of the ring signature is verified. The signature method is as described in S601 above, and will not be repeated here.

[0118] In the case of a valid ring signature, for proof of origin Validity verification is also performed, including verification of the source traceability proof. The method of validity verification and the verification information The verification method is the same, so it will not be repeated here.

[0119] Example, for proof of origin The expression used for verification can be represented as: If the output is 1, then the proof of origin is confirmed. Valid; if the output is 0, the proof of origin is confirmed. Invalid. If proven by traceability. If valid, then the identity information of the target signer traced by the tracer is correct.

[0120] The traceable ring-based collaborative signature method provided in the above embodiments involves the verifier performing dual verification of the tracer's tracing results. First, the validity of the original signature is confirmed, and then the mathematical completeness of the tracing proof is verified. Only when both verifications pass is the tracing result deemed legal and valid; otherwise, it is considered invalid. This mechanism prevents single-point abuse of power through decentralized adjudication, ensuring the fairness of the tracing system.

[0121] On the basis of the method embodiments, the application further provides a traceable ring-type collaborative signature device. Figure 10 A structure diagram of the traceable ring-type collaborative signature device provided by the application is shown in the figure, which can include: Figure 10 An information acquisition module 801 is configured to acquire system public parameters, a traceability public key, a ring structure composed of a plurality of user public keys, and a message to be signed. A random vector generation module 802 is configured to generate a binary string random vector of each binary bit of the binary position index according to the binary position index of the target signer in the ring structure. An information encryption module 803 is configured to encrypt each binary bit according to a traceability base matrix in the system public parameters, the binary string random vector of each binary bit, and the traceability public key, and generate encrypted index information. A proof information generation module 804 is configured to generate proof information by using a zero-knowledge proof generation algorithm according to the system public parameters, the traceability public key, the ring structure, the encrypted index information, a private key of the target signer, the binary position index, the binary string random vector, and the message to be signed. A ring signature generation module 805 is configured to generate a ring signature according to the encrypted index information and the proof information, wherein the traceability is used to perform traceability authentication on the ring signature by using a traceability private key.

[0122] Optionally, the information acquisition module 801 is specifically configured to randomly sample a short matrix and an error matrix from a discrete Gaussian distribution matrix; use the short matrix as a traceability private key; and generate a traceability public key according to a traceability base matrix, the error matrix, and the short matrix.

[0123] Optionally, the information acquisition module 801 is further configured to randomly sample a short vector as a user private key of each user from a discrete Gaussian distribution vector; and generate a user public key of each user according to a user public key matrix in the system public parameters and the short vector.

[0124] Optionally, the information encryption module 803 is specifically configured to generate a first encrypted index component of each binary bit according to the traceability base matrix and the binary string random vector of each binary bit; encrypt each binary bit according to the traceability public key and the binary string random vector of each binary bit to generate a second encrypted index component of each binary bit; and generate the encrypted index information according to the first encrypted index components and the second encrypted index components of a plurality of binary bits in the binary position index.

[0125] Optionally, the device can further include: ​The validity verification module 806 is configured to construct a challenge value by using a preset hash function according to the system public parameter, the tracer public key, the ring structure, the encrypted index information and the to-be-signed message; and verify the validity of the ring signature by using a zero-knowledge proof verification algorithm according to the challenge value and the proof information.

[0126] Optionally, the validity verification module 806 is further configured to verify the validity of the ring signature. The tracing module 807 is configured to, if the ring signature is a valid signature, decrypt the encrypted index information according to the tracer private key to determine a target position index of a target signer; determine a target user public key of the target signer in the ring structure according to the target position index; and generate a tracing proof according to the tracer public key, the ring signature and the target user public key, the tracing proof indicating that the decryption process is correct and the target user public key is the user public key of the target signer.

[0127] Optionally, the tracing module 807 is specifically configured to decrypt the encrypted index information according to the tracer private key to generate a noise decryption result of each binary bit; generate a reconstruction result of each binary bit according to a comparison result of the noise decryption result of each binary bit and a preset threshold; and determine the target position index according to the reconstruction result of the plurality of binary bits.

[0128] Optionally, the validity verification module 806 is further configured to verify the validity of the ring signature and the tracing proof; and if both the ring signature and the tracing proof are valid, determine that the tracing result is correct.

[0129] The apparatus is used for executing the method provided by the foregoing embodiments, and has similar implementation principles and technical effects, which will not be described here.

[0130] The above modules can be one or more integrated circuits configured to implement the above method, for example, one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs), etc. For another example, when the above module is implemented in the form of a processing element scheduling program code, the processing element can be a general-purpose processor, for example, a central processing unit (CPU) or other processor that can invoke program code. For another example, the modules can be integrated together to be implemented in the form of a system on a chip (SOC).

[0131] Figure 11 A schematic diagram of an electronic device provided by an embodiment of the present application is shown in Figure 11As shown, the electronic device 900 can include a processor 901, a storage medium 902, and a bus. The storage medium 902 stores program instructions executable by the processor 901. When the electronic device 900 is running, the processor 901 communicates with the storage medium 902 through the bus. The processor 901 executes the program instructions to perform the above method embodiments. The specific implementation and technical effects are similar, and will not be repeated here.

[0132] Optionally, the present application also provides a computer readable storage medium, and the storage medium stores a computer program. The computer program is run by a processor to execute the above method embodiments.

[0133] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other manners. For example, the apparatus embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, apparatuses or units, and can be electrical, mechanical or other forms.

[0134] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the present embodiment scheme.

[0135] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware, or in the form of hardware plus software functional unit.

[0136] The integrated unit implemented in the form of the software function unit can be stored in a computer readable storage medium. The software function unit is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of steps of the method described in various embodiments of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media capable of storing program codes.

[0137] The above merely describes specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A traceable ring-based collaborative signature method, characterized in that, The method includes: Obtain system public parameters, tracer public key, ring structure composed of multiple user public keys, and message to be signed; Based on the binary position index of the target signer in the ring structure, generate a random vector of binary strings for each binary bit of the binary position index; Based on the tracer base matrix in the system public parameters, the random vector of the binary string for each binary bit, and the tracer public key, each binary bit is encrypted to generate encrypted index information; Based on the system public parameters, the tracer's public key, the ring structure, the encrypted index information, the target signer's private key, the binary position index, the binary string random vector, and the message to be signed, a zero-knowledge proof generation algorithm is used to generate proof information. A ring signature is generated based on the encrypted index information and the proof information, wherein the tracer uses the tracer's private key to perform traceability authentication of the ring signature.

2. The method as described in claim 1, characterized in that, The steps to obtain the source tracer's public key include: Randomly sample the short matrix and error matrix from the discrete Gaussian distribution matrix; The short matrix is ​​used as the source tracer's private key; The source tracer public key is generated based on the source tracer base matrix, the error matrix, and the short matrix.

3. The method as described in claim 1, characterized in that, The steps for generating the user's public key include: A short vector is randomly sampled from the discrete Gaussian distribution vector to serve as each user's private key; The user public key for each user is generated based on the user public key matrix in the system public parameters and the short vector.

4. The method as described in claim 1, characterized in that, The step of encrypting each binary bit based on the tracer base matrix in the system public parameters, the binary string random vector of each binary bit, and the tracer public key to generate encrypted index information includes: Based on the source tracer base matrix and the binary string random vector of each binary bit, generate the first encrypted index component of each binary bit; Based on the tracer's public key and the random vector of the binary string for each binary bit, each binary bit is encrypted to generate a second encrypted index component for each binary bit; The encrypted index information is generated based on the first encrypted index component and the second encrypted index component of multiple binary bits in the binary position index.

5. The method as described in claim 1, characterized in that, After generating the ring signature based on the encrypted index information and the proof information, the method further includes: Based on the system public parameters, the tracer's public key, the ring structure, the encrypted index information, and the message to be signed, a challenge value is constructed using a preset hash function; The validity of the ring signature is verified using a zero-knowledge proof verification algorithm based on the challenge value and the proof information.

6. The method as described in claim 1, characterized in that, The method further includes: The validity of the ring signature is verified. If the ring signature is a valid signature, the encrypted index information is decrypted according to the tracer's private key to determine the target location index of the target signer; The target signer's target user public key is determined in the ring structure based on the target location index; Based on the source tracer's public key, the ring signature, and the target user's public key, a source traceability certificate is generated, indicating that the decryption process was correct and that the target user's public key is the target signer's public key.

7. The method as described in claim 6, characterized in that, The step of decrypting the encrypted index information based on the tracer's private key to determine the target location index of the target signer includes: The encrypted index information is decrypted using the source tracer's private key to generate a noise decryption result for each binary bit; Based on the comparison between the noise decryption result of each binary bit and the preset threshold, a reconstruction result for each binary bit is generated; The target position index is determined based on the reconstruction results of multiple binary bits.

8. The method as described in claim 6, characterized in that, The method further includes: The validity of the ring signature and the proof of origin is verified; If both the ring signature and the source tracing proof are valid, the source tracing result is determined to be correct.

9. A traceable ring-type collaborative signature device, characterized in that, The device includes: The information acquisition module is used to acquire system public parameters, the tracer's public key, a ring structure composed of multiple user public keys, and the message to be signed; A random vector generation module is used to generate a random binary string vector for each binary bit of the binary position index based on the binary position index of the target signer in the ring structure. The information encryption module is used to encrypt each binary bit according to the tracer base matrix in the system public parameters, the binary string random vector of each binary bit, and the tracer public key, and generate encrypted index information; The proof information generation module is used to generate proof information using a zero-knowledge proof generation algorithm based on the system public parameters, the tracer's public key, the ring structure, the encrypted index information, the target signer's private key, the binary position index, the binary string random vector, and the message to be signed; The ring signature generation module is used to generate a ring signature based on the encrypted index information and the proof information, wherein the tracer is used to perform traceability authentication of the ring signature using the tracer's private key.

10. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the traceable ring-based collaborative signature method as described in any one of claims 1 to 8.

Images