A traceable blind signature data protection system based on SM9

Abstract

The present application relates to the technical field of identity authentication, and relates to a traceable blind signature data protection system based on SM9. A server initializes data protection parameters and discloses them. The server determines a private key of a first terminal and a data tracking label according to the data protection parameters, and sends them to the first terminal. The first terminal blinds transaction data according to the data protection parameters, the private key of the first terminal and the data tracking label, and determines blinded data. The blinded data is blindly signed through an SM9 algorithm. A deblinding key of the blindly signed blinded data is generated. The blindly signed blinded data is sent to the server. A second terminal purchases the blinded data through the server. The second terminal sends a decryption request and a purchase voucher to the first terminal and receives the deblinding key sent by the first terminal. The blindly signed blinded data is recovered according to the deblinding key. It can be ensured that the server and the second terminal cannot know the original data content before obtaining the deblinding key.

Description

Technical Field

[0001] This specification relates to the field of identity authentication technology, and in particular to a traceable blind signature data protection system based on SM9. Background Technology

[0002] In the digital economy era, data has become a key production factor, and data trading platforms, as the core hubs for promoting the efficient flow and value release of data, are becoming increasingly important. However, with the continuous expansion of data trading scale and the deepening of application scenarios, platforms have also exposed many risks and defects in terms of security protection, technical architecture, and governance mechanisms, which have hindered the healthy and orderly development of the data factor market.

[0003] Currently, data trading platforms generally face complex and diverse security threats. Cyberattack methods are constantly evolving, with frequent occurrences of various attack methods including Advanced Persistent Threats (APTs), man-in-the-middle attacks, and Distributed Denial-of-Service (DDoS) attacks. Because platforms need to handle massive, multi-source, and cross-domain data flows, traditional rule-based or feature-matching firewalls and intrusion detection mechanisms are insufficient to effectively identify and defend against new types of attacks, such as covert malicious traffic generated using artificial intelligence. Overall proactive defense capabilities are inadequate, making it difficult to ensure data privacy and security during data transactions. At the same time, a unified and authoritative data security protection standard and certification system at the industry level is still lacking, resulting in fragmented and inconsistent security technology solutions adopted by various platforms. Surveys show that currently only about 38% of trading platforms have implemented end-to-end data encryption protection, and most still rely on foreign encryption standards such as AES-256, posing potential backdoor risks. The lack of standardized protocols also makes it difficult for security authentication to be mutually trusted and interoperable during cross-platform data exchange, significantly increasing the risk of data interception, tampering, or leakage during transmission and interaction.

[0004] Furthermore, fundamental challenges exist in data ownership management and controllable circulation. Data possesses unique attributes such as unlimited replication, heterogeneity, and perishable value. While traditional encryption algorithms like RSA or SM2 can ensure confidentiality during transmission to some extent, they cannot effectively address the issues of ownership control and prevention of misuse after data transactions are completed. For example, an incident occurred on a medical data trading platform where a party illegally resold sensitive patient genetic information after decrypting the data, highlighting the technical and managerial blind spots where data is no longer bound by ownership once it is delivered.

[0005] Therefore, this specification provides a traceable blind signature data protection system based on SM9. Summary of the Invention

[0006] This specification provides a traceable blind signature data protection system based on SM9 to solve the aforementioned problems existing in the prior art.

[0007] The following technical solution is adopted in this specification:

[0008] This specification provides a traceable blind signature data protection system based on SM9. The system includes a first terminal, a second terminal, and a server, wherein:

[0009] The server is configured to initialize data protection parameters and disclose the data protection parameters; determine the private key and data tracking tag of the first terminal according to the data protection parameters, and send the private key and data tracking tag of the first terminal to the first terminal; receive blinded data after blind signing sent by the first terminal; receive a purchase request sent by the second terminal, and send the blinded data after blind signing to the second terminal according to the purchase request;

[0010] The first terminal is configured to: acquire the data protection parameters, the first terminal's private key, and the data tracking tag; blind the transaction data according to the data protection parameters, the first terminal's private key, and the data tracking tag to determine the blinded data; blindly sign the blinded data using the SM9 algorithm; generate a deblinding key for the blinded data after blind signing; send the blinded data after blind signing to the server; receive a decryption request and a purchase voucher from the second terminal; determine the legitimacy of the second terminal's identity based on the purchase voucher; and, if the second terminal's identity is legitimate, send the deblinding key to the second terminal according to the decryption request.

[0011] The second terminal is configured to send a purchase request to the server for the blinded data after blind signing; receive the blinded data after blind signing from the server; send the decryption request and the purchase certificate to the first terminal; receive the deblinding key from the first terminal; and restore the blinded data after blind signing according to the deblinding key.

[0012] Based on the aforementioned technical methods, blind signatures ensure that the server and second terminal cannot know the original data content before obtaining the deblinding key. This approach does not rely on a Certificate Authority (CA) certificate system and utilizes the identifier cryptography characteristics of SM9 to simplify key management, solving the problems of weak anti-copying capabilities and inflexible deblinding control in traditional blind signatures. It is suitable for data transaction scenarios in relevant critical information infrastructure. Furthermore, by introducing technologies such as "data tracking tags," newly uploaded blinded data is compared with various previously uploaded data on the server, preventing unauthorized copying and secondary data transactions.

[0013] Furthermore, the server is used to define an elliptic curve group of order n. , Bilinear pair The bilinear pair e satisfies ;

[0014] in, , For a finite field; The prime power is the preset value. The prime number is the one that is predefined. , t is the degree of the twist curve, d is the degree of expansion of the domain of the twist curve, and m is the number of embeddings; The corresponding first generator is , The corresponding second generator is ; Represents the multiplication group consisting of the non-zero elements of the finite field; a and b are any integers in the finite field; P and Q are respectively... , The point on top.

[0015] Based on the aforementioned technical means, by utilizing the identifier cryptographic characteristics of SM9 and elliptic curve group operations, blind signatures of sensitive data, secure transactions on trading platforms, controllable deblinding for buyers, and traceability of unauthorized copying are achieved.

[0016] Furthermore, the server is configured to determine a first random number and a second random number, calculate a system public key based on the first random number, and determine a data tracking public key based on the second random number; determine the public key of the first terminal based on the identifier of the first terminal and the identifier of the private key generation function; determine the private key of the first terminal based on the public key of the first terminal and the first random number; and determine a data tracking tag based on the public key of the first terminal and the second random number.

[0017] The calculation expressions for the system public key, the first terminal's public key, the first terminal's private key, the data tracking tag, and the data tracking public key are as follows:

[0018]

[0019]

[0020]

[0021]

[0022]

[0023] in, s is the system public key; s is the first random number; This is the public key of the first terminal; This is the identifier of the first terminal; Generate a function identifier for the private key. This indicates concatenation, where u is the implicit discrete logarithm; is the private key of the first terminal; T is the data tracking tag; The second random number; The public key is used to track the data. This is the preset first hash function.

[0024] Based on the aforementioned technical means, a dual-key system is implemented. A first random number 's' generates the private key for the first terminal, supporting SM9 blind signature functionality. A data tracking private key, i.e., a second random number 'a', exists independently of the signature system and is used solely to generate the data tracking tag 'T' and the data tracking public key. Even if the data tracking private key is leaked, it does not affect the security of the first terminal's private key; conversely, it does not, thus achieving separation of permissions. Furthermore, the first terminal's data tracking tag T is a "commitment" of its public key under the data tracking private key. Although the data is hidden during the blind signature process, all T associated with the data transaction can be recorded by the server. When accountability is needed (such as discovering illegal data dissemination), T in the data transaction can be obtained and used to...

[0025] And pairing operation to verify whether T is valid This process generates and locates the source of the data. The tracking process does not require decrypting the original data; it only verifies the binding relationship between the tag and the identity, thus complying with privacy protection principles.

[0026] Furthermore, the data protection parameters include at least P1, P2, e, , , , , , , , These are the preset second and third hash functions, respectively.

[0027] Furthermore, the first terminal is configured to determine the data fingerprint of the data to be traded based on the second hash function; determine the mapping value of the data to be traded based on the first generator and the data fingerprint; determine a third random number, and determine a blinding factor based on the third random number, the mapping value and the public key of the first terminal; and blind the data to be traded based on the blinding factor and the third hash function to obtain the blinded data.

[0028] The data fingerprint, the mapping value, the blinding factor, and the calculation expression for the blinded data of the data to be traded are determined as follows:

[0029]

[0030]

[0031]

[0032]

[0033] Where M is the data to be traded; h is the data fingerprint; The mapping value; The blinding factor; The third random number; Indicates XOR; This refers to the blinded data.

[0034] Based on the above technical means, through elliptic curve point mixing ( The H3 hash mask, while maintaining SM9 standard compatibility, achieves strong privacy protection, meaning it blinds irreversible data. Implicit identity binding supports controllable tracking. High efficiency and feasibility require only standard elliptic curve operations and hashing.

[0035] Furthermore, the first terminal is configured to: determine a fourth random number; determine a temporary public key based on the fourth random number and the first generator; determine a first challenge value based on the blinded data, the identifier of the first terminal, the version information of the data to be traded, the temporary public key, and the data tracking tag; determine a blinded response value based on the temporary public key, the first challenge value, and the private key of the first terminal; determine a blind signature of the blinded data based on the temporary public key, the blinded response value, and the data tracking tag; determine a deblinding factor based on the third random number; and determine a deblinding key based on the deblinding factor and the mapping value.

[0036] The calculation expressions for the temporary public key, the first challenge value, the blinding response value, and the unblinding factor are determined as follows:

[0037]

[0038]

[0039]

[0040]

[0041]

[0042] in, The temporary public key; c is the fourth random number; c is the first challenge value; ver is the version information of the data to be traded; Represents a string format; r is the blinded response value; The unblinding factor; Represents the modular inverse of the third random number; This indicates a blind signature.

[0043] Furthermore, the second terminal is configured to determine the deblinding response value based on the deblinding factor, the blinding response value, and the temporary public key; determine the blinding factor based on the deblinding factor, the public key of the first terminal, and the mapping value; and determine the data to be traded based on the blinding factor, the third hash function, and the blinding data.

[0044] The second terminal determines the calculation expressions for the deblinding response value, the blinding factor, and the data to be traded as follows:

[0045]

[0046]

[0047]

[0048] in, B is the deblinding response value; B is the deblinding factor; M is the data to be traded.

[0049] Furthermore, the second terminal is also used to determine the second challenge value based on the blinded data, the identifier of the first terminal, the version information of the data to be traded, the temporary public key, and the data tracking tag; and to verify the correctness of the calculated second challenge value.

[0050] Based on the aforementioned technical means, the second terminal can independently verify the authenticity of the signature without contacting the server or the first terminal, improving system availability and resistance to single points of failure. This not only protects the rights of the data recipient but also strengthens the entire system's anti-counterfeiting capabilities, contextual integrity, and decentralized trust, while fully complying with the SM9 national cryptographic standard and privacy protection objectives.

[0051] Furthermore, the system also includes a third terminal;

[0052] The server is used to send the data tracking tag to the third terminal;

[0053] The third terminal is configured to receive the data tracking tag; and verify whether the data tracking public key matches the public key of the first terminal based on the data tracking tag, the second generator, the public key of the first terminal, and the data tracking public key; if yes, it is determined that the blinded data belongs to the first terminal; if no, it is determined that the blinded data does not belong to the first terminal.

[0054] Based on the aforementioned technical means, the introduction of a third terminal and its bilinear pairing-based tracking tag verification mechanism marks a leap from "internal traceability" to a higher-level data governance system that is "externally verifiable and legally credible." This ensures the identification of the data source for the blinded data without sacrificing user privacy.

[0055] Furthermore, the server is configured to determine the public key of the first terminal based on the identifier of the first terminal and the identifier of the private key generation function; determine a third challenge value based on the blinded data, the version information of the data to be traded, the temporary public key, and the data tracking tag; and verify the blind signature of the blinded data based on the third challenge value.

[0056] Based on the aforementioned technical means, the server can actively verify the blind signature to ensure that the blinded data matches the claimed first terminal.

[0057] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0058] This solution uses blind signatures to ensure that the server and second terminal cannot know the original data content before obtaining the deblinding key. It does not rely on a Certification Authority (CA) certificate system and utilizes the identifier cryptography characteristics of SM9 to simplify key management, solving the problems of weak anti-copying capabilities and inflexible deblinding control in traditional blind signatures. It is suitable for data transaction scenarios in relevant critical information infrastructure. Furthermore, it introduces technologies such as "data tracking tags" to compare newly uploaded blinded data with various data previously uploaded to the server, preventing unauthorized copying and secondary data transactions. Attached Figure Description

[0059] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0060] Figure 1 A schematic diagram of the structure of a traceable blind signature data protection system based on SM9 provided in the embodiments of this specification;

[0061] Figure 2This is a schematic diagram of a data transaction provided in this specification;

[0062] Figure 3 This specification provides an interactive flowchart of a traceable blind signature data protection system.

[0063] Figure 4 A schematic diagram illustrating a traceable blind signature data protection method based on SM9 provided in this specification;

[0064] Figure 5 This specification provides a corresponding Figure 4 A schematic diagram of the structure of an electronic device. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments in this specification without creative effort are within the scope of protection of this application.

[0066] In embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0067] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0068] Figure 1 This is a schematic diagram of the structure of a traceable blind signature data protection system based on SM9, provided for an embodiment of this specification. The system includes a server and a terminal.

[0069] In the data trading market, data owners typically display data for sale on data trading platforms. When a user purchases this data on the platform, that user can be called a data buyer or a data user who will soon use the data. Therefore, when applying this to the SM9-based traceable blind signature data protection system provided in this manual, the data trading platform can be used as the server, the data owner as the first terminal (meaning the data owner uses the first terminal for data blinding and trading), and the data buyer or data user as the second terminal (meaning the data user uses the second terminal for data trading and decryption). The first terminal, second terminal, and server can communicate with each other.

[0070] In one or more embodiments of this specification, the server can be used to initialize data protection parameters related to blinding, blind signing, and encryption of data. These data protection parameters can be made public so that a first terminal and a second terminal can obtain them from the server. Of course, since the data protection parameters are public, not only the first and second terminals can obtain them, but other terminal devices capable of communicating with the server can also obtain them. Subsequently, based on the data protection parameters, the server can further determine the first terminal's private key and a data tracking tag that can be used by third parties for data monitoring and tracking, and the server will send the first terminal's private key and data tracking tag to the first terminal.

[0071] In one or more embodiments of this specification, a first terminal is used to obtain publicly disclosed data protection parameters from the server, as well as the private key and data tracking tag of the first terminal sent by the server. Then, the first terminal can blind the data to be traded (i.e., data to be listed on the data trading platform awaiting purchase) according to the data protection parameters, the first terminal's private key, and the data tracking tag, thus determining the blinded data. Furthermore, the first terminal can also blind-sign the blinded data using the SM9 algorithm, thus determining the blinded data after blind signing. Of course, to facilitate deblinding by the buyer after the blinded data is sold, the first terminal can also generate a deblinding key for the blinded data. Afterwards, the first terminal can send the blind-signed data to the server, where it is listed and displayed as a product on the server (i.e., the data trading platform).

[0072] In one or more embodiments of this specification, the server can receive blinded data after blind signing sent by the first terminal, and then the server can make the blinded data after blind signing available for purchase by other terminals.

[0073] In one or more embodiments of this specification, a second terminal is used to send a purchase request to the server to purchase the blinded data after the first terminal sends the blind signature.

[0074] Then, the server will receive the purchase request sent by the second terminal, and according to the purchase request, send the blinded data after blind signing sent by the first terminal to the second terminal.

[0075] In this specification, the second terminal can receive blinded data after blind signing sent by the server. Of course, the blinded data received by the second terminal cannot be used directly at this point. The second terminal can then communicate with the first terminal through the server. The second terminal can provide the first terminal with proof of purchase for the blinded data from the server (such as the order number or payment proof from the data trading platform), thereby enabling the first terminal to verify the correctness of the second terminal's identity. Based on this, the second terminal can send a decryption request to the first terminal to obtain the deblinding key.

[0076] Next, the first terminal receives the decryption request and purchase voucher from the second terminal. Based on the purchase voucher, the server (i.e., the data trading platform) verifies the legitimacy of the second terminal's identity. If the second terminal's identity is verified, the deblinding key is sent to the second terminal according to the decryption request.

[0077] The second terminal can then receive the deblinding key sent by the first terminal. Based on the deblinding key, it can then recover the blinded data after the blind signature. Of course, in this specification, the second terminal can also upload blinded data to the server for sale and display, and other terminals (including the first terminal) can also purchase the blinded data uploaded by the second terminal on the server. Therefore, this specification does not fix the identities of the first and second terminals; in any data transaction on the server, the data seller can be the first terminal, and the data buyer can be the second terminal.

[0078] based on Figure 1 The illustrated traceable blind signature data protection system based on SM9 ensures that the server and second terminal cannot know the original data content before obtaining the deblinding key. It does not rely on a Certification Authority (CA) certificate system and utilizes the identifier cryptography characteristics of SM9 to simplify key management, solving the problems of weak anti-copying capabilities and inflexible deblinding control in traditional blind signatures. It is suitable for data transaction scenarios in relevant critical information infrastructure. Furthermore, by introducing technologies such as "data tracking tags," newly uploaded blinded data is compared with various previously uploaded data on the server to prevent unauthorized copying and secondary data transactions.

[0079] Furthermore, in one or more embodiments of this specification, the server is used to define an elliptic curve group of order n. , Bilinear pair The bilinear pair e satisfies .

[0080] in, , It is a finite field. It is a predefined prime power (referring to a number that can be expressed as an integer power of a prime number). For the preset prime number, , t is the preset number of twist curve iterations. d is the preset number of expansions of the domain of the twist curve; when d is 1... and All are prime numbers. (Based on the preset prime number...) When choosing a prime number, you can select a very large prime number (i.e., a large prime number, usually referring to the largest known prime number, such as a Mersenne prime). and This can be used to determine the embedding order m, which ensures that the two n-order elliptic curve groups mentioned above are embedded into... The above definitions are all common expressions in cryptography. The corresponding first generator is , The corresponding second generator is The order of both the first and second generators is n. Let P represent the multiplication group consisting of the non-zero elements of a finite field. a and b are arbitrary integers in the finite field. P and Q are respectively... , The point on top.

[0081] The definition provided by the server can be summarized as follows: Let... , It is a finite field. , Each represents an elliptic curve. Existence Contains a subgroup of order n, G1∈ ,and There exists another n-order subgroup G2∈ Define a bilinear pair e.

[0082]

[0083] Furthermore, in one or more embodiments of this specification, the server may have a built-in professional key management center or a cooperating third-party security service provider acting as a key generation center (KGC). Through the KGC, the server can determine a first random number and a second random number (which can be used as the data tracking private key), and can calculate the system public key based on the first random number, and determine the data tracking public key based on the second random number. Then, based on the identifier of the first terminal and the identifier of the private key generation function, the server determines the public key of the first terminal. After that, the server determines the private key of the first terminal based on the public key of the first terminal and the first random number. Finally, the server can determine the data tracking tag based on the public key of the first terminal and the second random number.

[0084] Among them, the server can be from The first and second random numbers are randomly determined. ={1,2,…,n 1}.

[0085] The calculation expressions for the computing system public key, the first terminal's public key, the first terminal's private key, the data tracking tag, and the data tracking public key are as follows:

[0086]

[0087]

[0088]

[0089]

[0090]

[0091] in, is the system public key. s is the first random number. This is the public key of the first terminal. This serves as the identifier for the first terminal, and can be its unified social credit code, ID number, or similar identifier. Generate a function identifier for the preset private key. This indicates concatenation, where u is the implicit discrete logarithm, and u is a pair of... The implicit discrete logarithm is generated naturally during the calculation process. is the private key of the first terminal. T is the data tracking tag. This is the second random number, which is also the data tracking private key. Use public keys for data tracking. This is the preset first hash function.

[0092] In one or more embodiments of this specification, the data protection parameters disclosed by the server include at least P1, P2, e, , , , , , , , These are the preset second and third hash functions, respectively.

[0093] in, , , These are the preset first hash function, second hash function, and third hash function, respectively.

[0094] Mapping binary strings of arbitrary length to groups The group elements of order n. Therefore, the identifier of the first terminal can be... and private key generation function identifier After concatenation, the first hash function is used. The spliced ​​result Calculations yield the following results. In the context of Implicit discrete logarithms are naturally generated during the calculation process. Multiplying the implicit discrete logarithm by the first generator also yields the result. .

[0095] It maps input data of arbitrary length (such as data to be traded, blinded data, identity identifiers, etc.) to binary strings of fixed length.

[0096] This maps points on an elliptic curve group to a binary string of fixed length.

[0097] In one or more embodiments of this specification, a first terminal is used to determine the data fingerprint, i.e., the hash value, of the data to be traded based on a second hash function. Then, based on a first generator and the data fingerprint, a mapping value for the data to be traded is determined, that is, the hash value is mapped to a point on an elliptic curve group. The first terminal then determines a third random number and, based on the third random number, the mapping value, and the public key of the first terminal, determines a blinding factor. Based on the blinding factor and the third hash function, the data to be traded is blinded to obtain blinded data. The third random number can also be obtained from... The randomized selection is used to calculate the blinding factor.

[0098] The calculation expressions for the data fingerprint, mapping value, blinding factor, and blinding data of the data to be traded are determined as follows:

[0099]

[0100]

[0101]

[0102]

[0103] Where M represents the data to be traded, and h represents the data fingerprint. The data to be traded, M, is substituted into the second hash function (represented as follows). ), determine the hash value of M in binary string form as the data fingerprint. This is the mapped value. It is a blinding factor. It is the third random number. It represents XOR. This is blinded data. Among them, due to the blinding factor B and... Relevant and confirmed and The corresponding first generator is Therefore, the blinding factor B can be substituted into the third hash function (represented as follows). After passing through the third hash function, the blinding factor B is converted into a binary string, which can then be XORed with the data to be traded M to obtain the blinded data. .

[0104] Furthermore, in this specification, the first terminal can also be used to... The process begins by determining a fourth random number, used exclusively for this blind signature operation. Based on this fourth random number and the first generator, a temporary public key is determined. Then, based on the blinded data, the identifier of the first terminal, the version information of the data to be traded, the temporary public key, and the data tracking tag, a first challenge value is determined. Next, the first terminal determines a blinded response value based on the temporary public key, the first challenge value, and the first terminal's private key. Finally, based on the temporary public key, the blinded response value, and the data tracking tag, a blind signature is performed on the blinded data to determine the blinded signature. Finally, the first terminal determines a deblinding factor based on a third random number. And based on the deblinding factor and the mapping value, a deblinding key is determined.

[0105] The calculation expressions for the temporary public key, the first challenge value, the blinding response value, and the unblinding factor are determined as follows:

[0106]

[0107]

[0108]

[0109]

[0110] in, For temporary public keys, is the fourth random number. c is the first challenge value. ver is the version information of the data to be traded. This version information is determined in advance for each version of the data to be traded. For example, the data to be traded in version 1.0 has its version information for version 1.0, and the data to be traded in version 2.0 has its version information for version 2.0. The version information can be determined through the data to be traded. This is represented as a string. Therefore, the first terminal can then display the version information and blinded data of the data to be traded. , , , After concatenation, the result is fed into the second hash function to calculate the first challenge value c. r is the blinded response value. This is the unblinding factor. Represented as a third random number exist The modular inverse in the equation, that is, the one that, under modulo n operations, makes... Integers that are true. Blinded data. A blind signature can be represented as .

[0111] In one or more embodiments of this specification, the second terminal purchases blinded data after blind signing through the server. And obtain the unblinding factor through the first terminal. and mapping value After the deblinding key is assembled, the blinded data can be processed. Deblinding also allows verification of the blind signature. .

[0112] Specifically, the second terminal determines the deblinding response value based on the deblinding factor, the deblinding response value, and the temporary public key. Then, based on the deblinding factor, the first terminal's public key, and the mapping value, it determines the deblinding factor. Finally, the second terminal determines the data to be traded based on the deblinding factor, the third hash function, and the deblinded data.

[0113] The second terminal determines the calculation expressions for the deblinding response value, the blinding factor, and the data to be traded as follows:

[0114]

[0115]

[0116]

[0117] in, B represents the deblinding response value. B is the blinding factor. M represents the data to be traded.

[0118] Furthermore, the second terminal is also used to determine the second challenge value based on the blinded data, the identifier of the first terminal, the version information of the data to be traded, the temporary public key, and the data tracking tag, and to verify the correctness of the calculated second challenge value.

[0119] The formula for calculating the second challenge value using the second terminal is:

[0120]

[0121] The expression for verifying the second challenge value is:

[0122]

[0123] In calculating the second challenge value, the second terminal is unsure whether the transaction data obtained from deblinding is necessarily correct, thus requiring verification. Therefore, the second terminal is also unsure whether its calculated second challenge value will be the same as the first challenge value calculated by the first terminal. Therefore, the sign of the second challenge value in the above calculation expression for the second terminal is set to... Then, the second terminal can perform verification. In the expression for verifying the second challenge value, the question mark above the equals sign indicates that the second terminal is unsure whether the verification results are equal before calculation; hence, the question mark is used. Of course, if the second terminal determines that they are equal after calculation, it means that the second challenge value calculated by the second terminal is correct, further demonstrating that the second terminal's verification of the blind signature is error-free, and the recovered transaction data is correct.

[0124] Figure 2 This is a schematic diagram of a data transaction provided in this specification. (For example...) Figure 2 As shown, the first terminal can send blinded data to the server, so that the second terminal can purchase blinded data on the server. Furthermore, the SM9-based traceable blind signature data protection system also includes a third terminal. This third terminal can be a regulatory body responsible for overseeing or monitoring data transactions between the first and second terminals, and can be used to detect and trace the ownership of the blinded data. The specific process is as follows.

[0125] Therefore, the server can also be used to send data tracking tags to third-party terminals.

[0126] The third terminal can be used to obtain data tracking tags and data protection parameters from the server. Then, the third terminal can verify whether the data tracking public key matches the first terminal's public key based on the data tracking tag, the second generator, the first terminal's public key, and the data tracking public key. If they match, it is determined that the blinded data was sent by the first terminal and belongs to the first terminal. The third terminal can then verify that T belongs to the first terminal. If the data is confirmed to have originated from the first terminal, data tracking can be performed to verify data ownership. Otherwise, the data is determined not to belong to the first terminal, and the data transaction is considered an error.

[0127] The expression used for verification by the third terminal is:

[0128]

[0129] In this instruction manual, such as This form of calculation, based on the bilinear pair e, can be referenced to this property. To perform specific calculations, abbreviated as This format is the common way of writing it.

[0130] In one or more embodiments of this specification, after receiving the blinded data after blind signing sent by the first terminal, the server may also verify the blind signature of the blinded data to verify whether it is a signature generated by the first terminal, so as to ensure that the received blinded data is the data blinded by the first terminal.

[0131] Specifically, the server can also determine the public key of the first terminal based on its identifier and the private key generation function identifier. Then, based on the blinded data, the version information of the data to be traded, the temporary public key, and the data tracking tag, it determines a third challenge value. Finally, the server verifies the blind signature of the blinded data based on the third challenge value to determine whether it was generated by the first terminal.

[0132] Determine the public key of the first terminal and the third challenge value (whose symbol is also ). The expressions for ) are as follows:

[0133]

[0134]

[0135] Next, verify whether the following equation is true (if both sides of the equation are equal, it is true). If it is true, blindly sign it without error, and it is signed by the first terminal.

[0136]

[0137] To facilitate understanding of the above data transaction process, based on Figure 1 The traceable blind signature data protection system shown in this specification provides an interactive flowchart of the system, such as... Figure 3 As shown.

[0138] S1: The server initializes the data protection parameters and exposes them.

[0139] In one or more embodiments of this specification, the server may initialize data protection parameters and disclose the data protection parameters.

[0140] S2: The server determines the private key and data tracking tag of the first terminal based on the data protection parameters, and sends the private key and data tracking tag of the first terminal to the first terminal.

[0141] In one or more embodiments of this specification, the server may further determine the private key of the first terminal and the data tracking tag that can be used by third parties for data monitoring and tracking based on data protection parameters, and the server will send the private key and data tracking tag of the first terminal to the first terminal.

[0142] In one or more embodiments of this specification, Figure 3 The intermediate step S2 may also include S21 and S22.

[0143] Specifically, the server sends a data tracking tag to the third terminal. The third terminal receives the data tracking tag and obtains the data protection parameters. Based on the data tracking tag, the second generator, the first terminal's public key, and the data tracking public key, it verifies whether the data tracking public key matches the first terminal's public key. If yes, it determines that the blinded data belongs to the first terminal; otherwise, it determines that the blinded data does not belong to the first terminal.

[0144] S3: The first terminal obtains the data protection parameters, the first terminal's private key, and the data tracking tag; based on the data protection parameters, the first terminal's private key, and the data tracking tag, it performs blinding on the transaction data to determine the blinded data; it performs blind signing on the blinded data using the SM9 algorithm; and it generates the deblinding key for the blinded data after blind signing.

[0145] In one or more embodiments of this specification, a first terminal obtains data protection parameters, its private key, and a data tracking tag. Based on the data protection parameters, the first terminal's private key, and the data tracking tag, the transaction data is blinded to determine the blinded data. The blinded data is then blind-signed using the SM9 algorithm to determine the blinded data after blind signing. A deblinding key for the blinded data after blind signing is generated.

[0146] S4: The first terminal sends the blind-signed data to the server.

[0147] In one or more embodiments of this specification, a first terminal sends blinded signed data to a server. The server receives the blinded signed data sent by the first terminal.

[0148] S5: The second terminal sends a purchase request to the server for blinded data after blind signing.

[0149] In one or more embodiments of this specification, the second terminal sends a purchase request to the server to purchase blinded data after blind signature. Of course, in actual data transactions, at the same time as initiating a purchase request, the payment corresponding to the blinded data purchased by the purchase request will also be sent to the server simultaneously. However, this specification does not focus on the transaction and circulation of funds, so it includes the process of the server receiving the purchase request and the payment and distributing the payment to the receiving account of the first terminal, which will not be described in detail here.

[0150] S6: The server receives the purchase request sent by the second terminal and sends the blinded signed data to the second terminal according to the purchase request.

[0151] In one or more embodiments of this specification, the server receives a purchase request sent by the second terminal and sends blinded signed data to the second terminal according to the purchase request.

[0152] S7: The second terminal receives the blinded data after blind signing sent by the server; and sends a decryption request and purchase certificate to the first terminal.

[0153] In one or more embodiments of this specification, the second terminal receives blinded data after blind signing sent by the server. At this time, the blinded data obtained by the second terminal cannot be used directly. The second terminal needs to send a decryption request and a purchase certificate to the first terminal.

[0154] S8: The first terminal sends a decryption request and a purchase certificate to the second terminal; based on the purchase certificate, the legitimacy of the second terminal's identity is determined; if the second terminal's identity is legitimate, the deblinding key is sent to the second terminal according to the decryption request.

[0155] In one or more embodiments of this specification, a first terminal receives a decryption request and a purchase certificate from a second terminal. Based on the purchase certificate, the legitimacy of the second terminal's identity is determined. If the second terminal's identity is legitimate, a deblinding key is sent to the second terminal according to the decryption request.

[0156] S9: The second terminal receives the deblinding key sent by the first terminal; based on the deblinding key, it recovers the blinded data after the blind signature.

[0157] In one or more embodiments of this specification, the second terminal receives the deblinding key sent by the first terminal. Then, based on the deblinding key, the blinded data after the blind signature is recovered.

[0158] For details regarding steps S1 to S9 above, please refer to the previous system description; they will not be described in detail here.

[0159] Based on one or more embodiments of this specification, a traceable blind signature data protection system based on SM9 is provided. Following the same approach, this specification also provides a corresponding traceable blind signature data protection method based on SM9, such as... Figure 4 As shown.

[0160] Figure 4 This is a schematic diagram of a traceable blind signature data protection method based on SM9, provided in this specification. The method is applied to a first terminal in a traceable blind signature data protection system and specifically includes:

[0161] S400: Obtain data protection parameters, the private key of the first terminal, and the data tracking tag.

[0162] In one or more embodiments of this specification, the first terminal obtains data protection parameters, the first terminal's private key, and a data tracking tag.

[0163] S402: Based on the data protection parameters, the private key of the first terminal, and the data tracking tag, the transaction data to be blinded is determined.

[0164] In one or more embodiments of this specification, the first terminal blinds the transaction data based on data protection parameters, the first terminal's private key, and a data tracking tag, thereby determining the blinded data.

[0165] S404: Perform blind signature on the blinded data using the SM9 algorithm.

[0166] In one or more embodiments of this specification, the first terminal performs blind signing on the blinded data using the SM9 algorithm.

[0167] S406: Generate the deblinding key for the blinded data after blind signing, and send the blinded data after blind signing to the server.

[0168] In one or more embodiments of this specification, the first terminal generates a deblinding key for the blinded data after blind signing and sends the blinded data after blind signing to the server.

[0169] S408: After the server sends the blind-signed data to the second terminal, it receives a decryption request and a purchase certificate from the second terminal; based on the purchase certificate, it determines the legitimacy of the second terminal's identity; if the second terminal's identity is legitimate, it sends the deblinding key to the second terminal based on the decryption request, so that the second terminal can recover the blind-signed data based on the deblinding key.

[0170] In one or more embodiments of this specification, after the server sends the blinded data after blind signing to the second terminal, the first terminal receives a decryption request sent by the second terminal, and sends the deblinding key to the second terminal according to the decryption request, so that the second terminal can recover the blinded data after blind signing according to the deblinding key.

[0171] For details of steps S400 to S408 in the above method, please refer to the previous system description, and they will not be described in detail here.

[0172] based on Figure 4 This specification provides a traceable blind signature data protection method based on SM9. Through blind signatures, it ensures that the server and second terminal cannot know the original data content before obtaining the deblinding key. It does not rely on the Certification Authority (CA) certificate system and utilizes the identity cryptography characteristics of SM9 to simplify key management, solving the problems of weak anti-copying capabilities and inflexible deblinding control in traditional blind signatures. It is suitable for data transaction scenarios in relevant critical information infrastructure. Furthermore, it introduces technologies such as "data tracking tags" to compare newly uploaded blinded data with various previously uploaded data on the server, preventing unauthorized copying and secondary data transactions.

[0173] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 4 This paper presents a traceable blind signature data protection method based on SM9.

[0174] This instruction manual also provides Figure 5 The diagram shows a schematic structural representation of the electronic device. Figure 5 As shown, at the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above. Figure 4 This paper presents a traceable blind signature data protection method based on SM9.

[0175] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0176] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0177] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0178] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0179] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0180] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0181] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0182] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0183] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0184] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0185] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0186] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic or disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0187] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0188] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0189] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0190] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0191] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A traceable blind signature data protection system based on SM9, characterized in that, The system includes a first terminal, a second terminal, and a server, wherein: The server is used to initialize data protection parameters and expose the data protection parameters, which at least include P1, P2, e, ... , , , , , Based on the data protection parameters, determine the private key and data tracking tag of the first terminal, and send the private key and data tracking tag of the first terminal to the first terminal; receive the blinded data after blind signing sent by the first terminal; receive the purchase request sent by the second terminal, and send the blinded data after blind signing to the second terminal according to the purchase request; in, Elliptic curve group defined for the server The corresponding first generator, Elliptic curve group defined for the server The corresponding second generator; Bilinear pairs defined for the server; , , These are the preset first hash function, second hash function, and third hash function, respectively; , , These are the system public key, the public key of the first terminal, and the data tracking public key, respectively. The first terminal is configured to acquire the data protection parameters, the private key of the first terminal, and the data tracking tag; determine the data fingerprint of the data to be traded according to the second hash function; determine the mapping value of the data to be traded according to the first generator and the data fingerprint; determine a third random number, and determine a blinding factor according to the third random number, the mapping value, and the public key of the first terminal; blind the data to be traded according to the blinding factor and the third hash function to obtain the blinded data; determine a fourth random number, and determine a temporary public key according to the fourth random number and the first generator; and determine the temporary public key according to the blinded data, the identifier of the first terminal, the version information of the data to be traded, and the temporary public key. The system uses a temporary public key and the data tracking tag to determine a first challenge value; it uses the temporary public key, the first challenge value, and the private key of the first terminal to determine a blinding response value; it uses the temporary public key, the blinding response value, and the data tracking tag to determine a blind signature for the blinded data; it uses the third random number to determine a deblinding factor; it uses the deblinding factor and the mapping value to determine a deblinding key; it sends the blinded data with the blind signature to the server; it receives a decryption request and a purchase voucher from the second terminal; it uses the purchase voucher to determine the legitimacy of the second terminal's identity; and if the second terminal's identity is legitimate, it sends the deblinding key to the second terminal according to the decryption request. The second terminal is configured to send a purchase request to the server for the blinded data after blind signing; receive the blinded data after blind signing from the server; send the decryption request and the purchase certificate to the first terminal; receive the deblinding key from the first terminal; and restore the blinded data after blind signing according to the deblinding key.

2. The traceable blind signature data protection system based on SM9 as described in claim 1, characterized in that, The server is used to define an elliptic curve group of order n. , Bilinear pair The bilinear pair e satisfies ; in, , For a finite field; The prime power is the preset value. The prime number is the one that is predefined. , t is the degree of the twist curve, d is the degree of expansion of the domain of the twist curve, and m is the number of embeddings; The corresponding first generator is , The corresponding second generator is ; Represents the multiplication group consisting of the non-zero elements of the finite field; a and b are any integers in the finite field; P and Q are respectively... , The point on top.

3. The traceable blind signature data protection system based on SM9 as described in claim 2, characterized in that, The server is configured to determine a first random number and a second random number, calculate a system public key based on the first random number, and determine a data tracking public key based on the second random number. The public key of the first terminal is determined based on the identifier of the first terminal and the identifier of the private key generation function. The private key of the first terminal is determined based on the public key of the first terminal and the first random number; the data tracking tag is determined based on the public key of the first terminal and the second random number. The calculation expressions for the system public key, the first terminal's public key, the first terminal's private key, the data tracking tag, and the data tracking public key are as follows: in, The system's public key; s is the first random number; This is the public key of the first terminal; This is the identifier of the first terminal; Generate a function identifier for the private key. This indicates concatenation, where u is the implicit discrete logarithm; is the private key of the first terminal; T is the data tracking tag; The second random number; The public key is used to track the data. This is the preset first hash function.

4. The traceable blind signature data protection system based on SM9 as described in claim 3, characterized in that, The data fingerprint, the mapping value, the blinding factor, and the calculation expression for the blinded data of the data to be traded are determined as follows: Where M is the data to be traded; h is the data fingerprint; The mapping value; The blinding factor; The third random number; Indicates XOR; This refers to the blinded data.

5. A traceable blind signature data protection system based on SM9 as described in claim 4, characterized in that, The calculation expressions for the temporary public key, the first challenge value, the blinding response value, and the unblinding factor are determined as follows: in, The temporary public key; c is the fourth random number; c is the first challenge value; ver is the version information of the data to be traded; Represents a string format; r is the blinded response value; The unblinding factor; Represents the modular inverse of the third random number; This indicates a blind signature.

6. The traceable blind signature data protection system based on SM9 as described in claim 5, characterized in that, The second terminal is configured to determine the deblinding response value based on the deblinding factor, the blinding response value, and the temporary public key; determine the blinding factor based on the deblinding factor, the public key of the first terminal, and the mapping value; and determine the data to be traded based on the blinding factor, the third hash function, and the blinding data. The second terminal determines the calculation expressions for the deblinding response value, the blinding factor, and the data to be traded as follows: in, B is the deblinding response value; B is the deblinding factor; M is the data to be traded.

7. A traceable blind signature data protection system based on SM9 as described in claim 6, characterized in that, The second terminal is further configured to determine a second challenge value based on the blinded data, the identifier of the first terminal, the version information of the data to be traded, the temporary public key, and the data tracking tag; and verify the correctness of the calculated second challenge value.

8. A traceable blind signature data protection system based on SM9 as described in claim 3, characterized in that, The system also includes a third terminal; The server is used to send the data tracking tag to the third terminal; The third terminal is used to receive the data tracking tag; Based on the data tracking tag, the second generator, the public key of the first terminal, and the data tracking public key, verify whether the data tracking public key matches the public key of the first terminal; if yes, determine that the blinded data belongs to the first terminal; if no, determine that the blinded data does not belong to the first terminal.

9. A traceable blind signature data protection system based on SM9 as described in claim 5, characterized in that, The server is configured to determine the public key of the first terminal based on the identifier of the first terminal and the identifier of the private key generation function. Based on the blinded data, the version information of the data to be traded, the temporary public key, and the data tracking tag, a third challenge value is determined; based on the third challenge value, the blind signature of the blinded data is verified.

Images