Efficient multi-authority responsibility investigation multi-party authorization method and device based on attribute encryption

Abstract

The invention discloses a high-efficiency multi-authority responsibility investigation multi-party authorization method and device based on attribute encryption, and belongs to the technical field of cryptography and information security. A multi-authority attribute-based encryption mechanism is adopted to protect a responsibility investigation private key, a signer encrypts a signature share and generates a zero-knowledge proof; after verification and certification of the combiner, an encrypted share is aggregated in a ciphertext domain to generate an aggregated ciphertext, the block chain stores a hash abstract, and an authorization tracker decrypts the aggregated ciphertext through an attribute key recovery responsibility investigation private key to recover a threshold signature and a participant set, so that cryptology privacy protection, constant-level responsibility investigation efficiency, decentralized governance and reliable auditing are realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cryptography and information security, and particularly relates to an efficient multi-authority accountability multi-party authorization method and device based on attribute encryption. BACKGROUND

[0002] With the acceleration of the digitalization process, multi-party collaborative authorization across agencies and trust domains has become a core requirement in key fields such as financial technology, digital government affairs, and medical health. For example, in a financial alliance chain, a large amount of clearing requires the joint approval of multiple banks, and in digital government affairs, the sharing of sensitive data requires the joint authorization of multiple regulatory departments. Such scenarios pose two core and conflicting requirements for the authorization mechanism: on the one hand, participants in normal business activities want to maintain default anonymity, and the outside world should not know the specific member identity of the participants in the authorization to protect the privacy and commercial sensitivity of the operation; on the other hand, in the event of malicious operation or the need for compliance audit, the system must be able to trace back to the real participant set accurately and irrefutably according to law.

[0003] Currently, the main technologies for realizing multi-party authorization include private threshold signature and accountable threshold signature. Private threshold signature schemes such as FROST achieve privacy protection in the signature generation process through multiple rounds of interaction, making it impossible for external observers to infer the participant set and threshold setting. However, the completely anonymous nature of this scheme makes it impossible to provide any accountability basis for subsequent audits. Accountable threshold signature schemes such as MuSig2 embed participant identity information into the signature structure, ensuring that each signature reveals all participant identities completely. However, this completely transparent approach completely sacrifices the privacy of the participants.

[0004] In recent years, privacy-protecting accountable threshold signature schemes have emerged in an attempt to balance these two needs. However, these schemes still have obvious defects: schemes based on plaintext commitments such as TAPS require signers to submit plaintext signature shares to the combiner, which maintains anonymity to the public, but the combiner can directly access all plaintext shares during aggregation, posing a privacy leakage risk; schemes based on encrypted shares such as MTAPS protect the visibility of shares to the combiner through public key encryption technology, but since they do not support homomorphic aggregation operations in the ciphertext domain, they require the decryption of all ciphertexts one by one during accountability, resulting in linear growth of storage and computing overhead with the number of participants, which is insufficient in large-scale scenarios; schemes based on dynamic notarization such as DeTAPS introduce blockchain random election and dynamic notary mechanisms, but they strongly depend on trusted execution environment hardware and require authorities to be online and participate in complex multi-party interaction protocols for a long time, which is quite different from the actual operation mode of regulatory departments as policy makers and post-auditors, and has limited engineering feasibility. SUMMARY

[0005] To solve the above technical problems, the application provides a high-efficiency multi-authority accountability multi-party authorization method and device based on attribute encryption to solve the problems existing in the prior art.

[0006] In a first aspect, to achieve the above object, the application provides a high-efficiency multi-authority accountability multi-party authorization method based on attribute encryption, comprising the following steps: Initialize the system to generate a threshold signature key and an accountability key, wherein the accountability private key is encrypted and protected by a multi-authority attribute-based encryption mechanism and a preset access policy; The signer uses a threshold signature private key share to generate a signature share for a message, encrypts the signature share using an accountability public key to obtain an encrypted share, and generates a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share; The aggregator collects the encrypted share and the zero-knowledge proof, verifies the zero-knowledge proof, and aggregates the encrypted share into an aggregated ciphertext using the homomorphic encryption feature; The aggregator generates a signature participation commitment vector and stores the hash digest of the aggregated ciphertext and the signature participation commitment vector to a blockchain; The authorized tracker obtains an attribute key from an attribute authority, decrypts and recovers the accountability private key, decrypts the aggregated ciphertext using the accountability private key to recover the threshold signature, and verifies the consistency of the threshold signature with the participant set.

[0007] Optionally, the process of initializing the system comprises: Generating a threshold BLS signature key pair, including a main public key and a private key share; Generating an EC-ElGamal accountability key pair, including an accountability public key and an accountability private key; Using a multi-authority attribute-based encryption mechanism, the accountability private key is encrypted by key encapsulation, wherein the symmetric key is encrypted by a multi-authority attribute-based encryption scheme and is bound to the access policy to form a tracking key package.

[0008] Optionally, the process of the signer generating the encrypted share and the zero-knowledge proof comprises: The signer calculates a message hash value and generates a BLS signature share using a threshold signature private key share; The BLS signature share is encrypted using an accountability public key and a random number to obtain an encrypted share; Witness values and public statements of the zero-knowledge proof are constructed, and a non-interactive zero-knowledge proof is generated to prove that the encrypted share corresponds to a legal signature share.

[0009] Optionally, the process of the aggregator verifying and aggregating comprises: The aggregator verifies the validity of the zero-knowledge proof in batches according to the public key of the signer; The Lagrange interpolation coefficient is calculated for threshold signature aggregation; By leveraging the homomorphic properties of EC-ElGamal, scalar multiplication and addition operations are performed on the encrypted shares to generate aggregated ciphertext of constant size; Construct a participant commitment vector, where each element is an encryption of the participant token or zero element.

[0010] Optionally, the process of storing the hash digest of the aggregated ciphertext and the signatory commitment vector to the blockchain includes: The combiner invokes the blockchain smart contract to write the hash values ​​of the message, aggregated ciphertext, and signature commitment vector into the blockchain ledger; The smart contract records the hash value and the system signature of the combiner, forming an immutable audit trail.

[0011] Optional, the authorized tracker's decryption and verification process includes: The tracker requests attribute keys from multiple attribute authorities and uses these attribute keys to decrypt the tracking key packet in order to recover the accountability private key. Use the accountability private key to decrypt the aggregated ciphertext to obtain the threshold signature, and decrypt the signatory commitment vector to obtain the participant set; Verify the cryptographic correctness of the threshold signature and cross-validate the consistency between the participant set and the threshold signature.

[0012] Secondly, the present invention also provides an efficient multi-authority accountability and multi-party authorization device based on attribute encryption, used to implement an efficient multi-authority accountability and multi-party authorization method based on attribute encryption, the device comprising: The initialization module is used to generate threshold signature keys and accountability keys, wherein the accountability private key is encrypted and protected by a multi-authority attribute base encryption mechanism and a preset access policy. The signature processing module enables the signer to generate a signature share for the message using the threshold signature private key share, encrypt the signature share using the accountability public key to obtain the encrypted share, and generate a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share. The aggregation processing module is used to enable the combiner to collect encrypted shares and zero-knowledge proofs, verify the zero-knowledge proofs, aggregate the encrypted shares into aggregated ciphertext using homomorphic encryption properties, and generate a sign-off commitment vector. The evidence storage module is used to store the hash digest of the aggregated ciphertext and the signatory commitment vector to the blockchain; The accountability processing module enables authorized trackers to obtain attribute keys from attribute authorities, decrypt and recover the accountability private key, use the accountability private key to decrypt aggregated ciphertext to recover the threshold signature, and verify the consistency of the threshold signature with the participant set.

[0013] Thirdly, the present invention also provides a computer terminal device, comprising: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the efficient multi-authority accountability and multi-party authorization method based on attribute encryption in the first aspect above.

[0014] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the efficient multi-authority accountability and multi-party authorization method based on attribute encryption described in the first aspect above.

[0015] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the efficient multi-authority accountability and multi-party authorization method based on attribute encryption described in the first aspect above.

[0016] Compared with the prior art, the present invention has the following advantages and technical effects: This invention provides an efficient multi-authority accountability and multi-party authorization method based on attribute encryption. By introducing homomorphic ciphertext aggregation and non-interactive zero-knowledge proof technology, this invention achieves cryptographic privacy protection at the combiner level, preventing the combiner from accessing plaintext signature shares during verification and aggregation, thus avoiding privacy leakage risks and not relying on trusted execution environment hardware. Utilizing homomorphic encryption characteristics, multiple encrypted shares are aggregated into a single, constant-size aggregated ciphertext, significantly reducing storage and accountability decryption overhead and improving scalability in large-scale scenarios. A multi-authority attribute-based encryption mechanism distributes accountability authority to multiple independent authoritative bodies, supporting flexible access policies. Simultaneously, the authoritative bodies adopt a passive participation model, eliminating the need for real-time online presence or complex interactions, reducing system coordination costs. Combined with blockchain-based key operation digests, an immutable, lightweight audit trail is formed, facilitating post-audit and dispute resolution. Attached Figure Description

[0017] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart illustrating the authorization and signing process for signers and combiners according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating the tracking and auditing process after a request for accountability is accepted, as described in this embodiment of the invention. Figure 3 This is a schematic diagram illustrating a high-level interaction example of the traceable privacy threshold signature scheme according to an embodiment of the present invention. Detailed Implementation

[0018] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0020] With the acceleration of global digitalization, multi-party collaborative authorization across institutions and trust domains has become a core requirement in key areas such as fintech, digital government, healthcare, and the industrial internet. For example, in a financial consortium blockchain, a large-scale settlement may require joint approval from multiple banks; in digital government, the sharing of sensitive data requires joint authorization from multiple regulatory departments.

[0021] Threshold signatures are a key cryptographic primitive for implementing multi-party authorization. They allow the delegation of signing authority to multiple parties. One participant, only when at least indivual( Only when each participating party submits a "signature share" can they aggregate into a single, valid system signature for external use.

[0022] However, in complex cross-domain collaboration scenarios, authorization mechanisms face two core and conflicting challenges: privacy protection and accountability.

[0023] Privacy Protection: Participants (such as financial institutions) wish to maintain "default anonymity" in normal business activities. That is, the outside world should not know the specific details of their activities. One member participated in a authorization process to protect the privacy and commercial sensitivity of their operations.

[0024] Accountability: In the event of malicious conduct (such as collusion, irregular approvals) or a compliance audit, the system must be able to "hold individuals accountable according to law." That is, one or more authorized regulatory entities (such as an audit committee) must be able to accurately and irrefutably trace back to the true set of participants in that authorization.

[0025] While traditional BLS threshold signature schemes offer efficient aggregation and anonymity, their "complete anonymity" makes them unsuitable for accountability requirements. Therefore, designing a multi-party authorization scheme that skillfully balances the conflicting needs of "default privacy" and "on-demand accountability," while adapting to decentralized governance environments, has become a pressing technical challenge in the fields of information security and distributed systems.

[0026] Besides the two main directions of private threshold signatures and accountable threshold signatures, the industry has seen the emergence of various accountable threshold signature schemes to address the need for multi-party authorization that balances privacy and accountability. These schemes attempt to introduce additional cryptographic components on top of traditional threshold signatures to achieve conditional recovery of the signer's identity.

[0027] Based on their implementation mechanisms and levels of privacy protection, existing technical solutions can be broadly categorized into the types shown in Table 1: Table 1

[0028] Private Threshold Signature (PTS): The goal of this type of scheme is to hide the internal details of the signature process. Modern PTS schemes, represented by FROST, are built on the Schnorr signature system and achieve distributed signature generation through a carefully designed multi-round interaction protocol. The core innovation of this scheme is that, whether in the standard multi-round interaction mode or in a scenario using distributed key generation (DKG) for trusted preprocessing, the final output signature is completely identical in form to the standard Schnorr signature, making it impossible for external observers to infer the composition of the participant set S and the setting of the threshold value t from the signature itself. This "signature indistinguishability" provides the strongest privacy protection for participants, but it also leads to the inherent limitation of this type of scheme—because the information of the signature generation process is completely erased, similar to the early pure BLS scheme, FROST cannot provide any basis for accountability for subsequent auditing or dispute resolution.

[0029] Accountable Threshold Signature (ATS): This type of scheme focuses on achieving complete privacy protection during the distributed signature generation process. Unlike PTS, which pursues extreme privacy, ATS schemes are designed to embed participant identity information into the signature structure, making the signature itself a verifiable proof of participation. This research direction can be traced back to the theoretical framework established by earlier works such as ASM (Accountable Subgroup Multisignatures). Currently, the new generation of schemes, represented by MuSig2, demonstrates the maturity of this technical approach—as an efficient two-round Schnorr multisignature protocol, MuSig2 implements an implicit identity binding mechanism for signatures in n-of-n scenarios, ensuring that each signature can fully reveal the identity information of all participants. Although MuSig2 is natively designed for n-of-n environments, its underlying cryptographic construction lays the technical foundation for accountability research in broader t-of-n threshold scenarios. However, the ability to hold individuals accountable comes at the cost of privacy—such schemes inherently require complete transparency of participant identities and threshold configurations to the verifier, which poses a fundamental limitation in many privacy-conscious application scenarios.

[0030] Privacy-conscious, accountability-based threshold signatures employ a hybrid approach, striving to strike a balance between privacy and accountability. This direction was initiated by Boneh and Komlo's TAPS (Threshold Signatures with Private Accountability) proposed in Crypto: a commitment mechanism makes the signature anonymous to the public, but authorized entities can track it using the key. Tracing back to signers. However, TAPS and its successors still have shortcomings: firstly, TAPS allows the combiner to directly access the plaintext shares of all participants during the aggregation phase. Furthermore, relying on a centralized combiner and tracker renders privacy ineffective for the combiner, potentially leading to unauthorized reuse of signature shares by curious combiners. To address the risk of privacy breaches among participants, MTAPS proposes using ElGamal to encrypt signature shares. And combined with zero-knowledge proofs (ZKP) Protects privacy on the combiner side, but does not support ciphertext aggregation, final signature. contain Each encrypted message has its own storage and tracking costs. Linear relationship. Recent DeTAPS attempts to alleviate centralization and efficiency issues by randomly electing roles on the blockchain and introducing a Trusted Execution Environment (TEE), but its privacy heavily relies on the TEE, resulting in plaintext share. It will still be decrypted and exposed in the combiner's enclave. At the same time, its Key-Aggregate Searchable Encryption (KASE) + Dynamic Threshold Public-Key Encryption (DTPKE) accountability mechanism requires the notary to be online for a long time and participate in complex interactions, which limits the feasibility of the project.

[0031] Therefore, the existing technology has the following shortcomings: 1) Privacy protection mechanisms have blind spots and ambiguous security boundaries: Different schemes exhibit different limitations in privacy protection. Plaintext-based schemes require signers to submit plaintext signature shares and their cryptographic commitments to the combiner. Although this maintains anonymity to the public, the combiner can directly access all plaintext shares during the aggregation phase, leading to unauthorized reuse and the potential for gradually deducing private key shares through statistical analysis or algebraic attacks. Hardware-assisted schemes introduce a trusted execution environment to protect the combiner's internal operations, but their privacy largely depends on hardware security. The combiner must first decrypt each signer's encrypted shares to obtain the plaintext within an isolated execution domain, aggregate the plaintext, and then re-encrypt it. This means that sensitive plaintext shares do exist briefly in memory, potentially facing hardware side-channel attacks, memory bus sniffing, or known hardware vulnerabilities. This limits the actual strength of privacy protection to hardware security, raising concerns about its application in high-security scenarios.

[0032] 2) Limited efficiency in the accountability process and insufficient scalability in large-scale scenarios: Although the scheme based on encrypted shares protects the visibility of shares to the combiner through public-key encryption, it does not support homomorphic aggregation operations on ciphertext fields. Therefore, the combiner can only collect the independent ciphertexts of all participants, resulting in a complete set of encrypted shares in the final signature. This forces the tracer to download and decrypt all ciphertexts one by one when performing accountability. The accountability overhead is linearly related to the number of participants, leading to high storage and computation costs in large-scale distributed applications. This poses a challenge to the scalability of the scheme, making it difficult to efficiently support the actual business needs of a large number of participants.

[0033] 3) Deficiencies in governance architecture design and disconnect between authoritative institution participation models and reality: Existing solutions exhibit different trade-offs in governance design. Some cryptographic solutions rely on a single, pre-designated tracker holding the tracking private key for decryption and accountability. This centralized trust model suffers from centralized trust and single-point dependence, which differs from the multi-authority joint governance and checks and balances advocated by modern regulatory systems. While dynamic notarization-based solutions introduce blockchain random election and dynamic notary mechanisms, their accountability process requires authoritative institutions (notaries) to remain online for extended periods and actively participate in each round of accountability operations. This includes continuously searching blockchain data using dedicated keys to identify relevant tasks and participating in complex multi-party interaction protocols to execute threshold decryption. This design positions authoritative institutions as high-load online cryptographic computing nodes, which differs significantly from the actual operating model of regulatory departments (such as public security and financial regulatory agencies) primarily acting as policymakers and ex-post auditors. This may lead to higher participation costs for authoritative institutions, greater difficulty in cross-domain coordination, and feasibility challenges in engineering implementation.

[0034] 4) Lack of lightweight, tamper-proof audit trails: Most solutions do not take advantage of the immutability of blockchain to provide a globally consistent, lightweight audit log for critical operations.

[0035] To address the aforementioned issues, this invention proposes an efficient multi-authority accountability and multi-party authorization method based on attribute encryption, aiming to provide a solution that balances privacy protection, efficient accountability, decentralized governance, and engineering feasibility. Its specific objectives include: 1) Achieving cryptographic privacy protection at the combiner level: This invention does not rely on trusted execution environment hardware. By introducing ciphertext homomorphic aggregation and non-interactive zero-knowledge proof techniques, the combiner operates entirely within the ciphertext domain. The combiner can verify the correctness of the encrypted share through zero-knowledge proofs, but cannot decrypt to obtain any plaintext share. This achieves cryptographic invisibility of the share to the combiner, avoiding the problem in plaintext commitment-based schemes where the combiner can directly access the plaintext share.

[0036] 2) Reduced computational and storage overhead: Leveraging the homomorphic aggregation properties of ciphertexts, the combiner can aggregate multiple encrypted shares into a single, constant-size aggregate ciphertext for storage. The tracer only needs to perform a decryption operation on this aggregate ciphertext once to recover the final threshold signature. The decryption overhead of the trace signature is at the constant level, which has a significant efficiency advantage in scenarios with a large number of participants compared to linear overhead schemes that require decrypting all ciphertexts one by one.

[0037] 3) Implement a decentralized and flexible multi-authority governance architecture: Introduce a multi-authority attribute-based encryption mechanism to distribute accountability authority to multiple independent authoritative bodies (such as legal departments, technical departments, etc.). Trackers must meet preset attribute policies (such as "legal department and technical department") to perform decryption operations, avoiding centralized trust models that rely on a single tracker, while providing more flexible policy configuration capabilities than fixed-threshold decryption.

[0038] 4) Enhanced Applicability and Robustness: A key feature of this invention is that the authoritative body adopts a passive participation model in system operation. Its main responsibility is to issue attribute keys to authorized trackers according to governance regulations. Cryptographic operations such as signature generation, aggregation verification, and accountability decryption are all completed independently locally by the trackers, without requiring the authoritative body to participate online in real time or execute complex multi-party interaction protocols. This significantly reduces the participation cost of the authoritative body and the complexity of cross-domain coordination of the system, which is more in line with the actual operating model of regulatory agencies as policymakers and ex-post auditors.

[0039] 5) Provides immutable lightweight audit support: Following the design principle of "off-chain computing and on-chain evidence storage", the cryptographic digests of key operations (such as aggregated ciphertext digests, system signatures, etc.) are anchored on the chain to form a globally consistent and publicly verifiable lightweight audit trail, which facilitates post-audit and dispute resolution, while avoiding the storage burden caused by putting a large amount of raw data on the chain.

[0040] This invention is applicable to multi-party collaborative authorization scenarios with strict requirements for operational privacy, traceability of responsibility, and decentralized governance, including but not limited to: financial consortium blockchains (cross-bank joint approval), digital government (cross-departmental data sharing), medical data (multi-institutional joint authorization), and industrial internet (multi-party confirmation of key instructions).

[0041] Example 1 This embodiment provides an efficient multi-authority accountability and multi-party authorization method based on attribute encryption, including: Initialize the system and generate a threshold signature key and an accountability key, wherein the accountability private key is encrypted and protected by a multi-authority attribute base encryption mechanism and a preset access policy. The signer uses the threshold signature private key share to generate a signature share for the message, uses the accountability public key to encrypt the signature share to obtain an encrypted share, and generates a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share; The combiner collects encrypted shares and zero-knowledge proofs, verifies the zero-knowledge proofs, and then uses homomorphic encryption to aggregate the encrypted shares into aggregate ciphertext. The combiner generates a signature commitment vector and stores the hash digest of the aggregated ciphertext and the signature commitment vector into the blockchain; The authorized tracker obtains the attribute key from the attribute authority, decrypts and recovers the accountability private key, uses the accountability private key to decrypt the aggregate ciphertext to recover the threshold signature, and verifies the consistency of the threshold signature with the participant set.

[0042] As one implementation method in this embodiment, the system initialization process includes: Generate a threshold BLS signature key pair, including the master public key and private key share; Generate an EC-ElGamal accountability key pair, including an accountability public key and an accountability private key; The accountability private key is encrypted using a multi-authority attribute-based encryption mechanism and is bound to the access policy to form a tracking key package.

[0043] The specific process includes three parts: the cryptographic basic parameter unit, the threshold key generation unit, and the attribute multi-authoritative accountability and authorization unit. (1) Cryptographic Foundation Parameter Unit: This unit is responsible for defining the global cryptographic foundation of the system. Select a unit that supports bilinear pairings. The pairing groups, among which All are prime numbers Cyclic group of order 1. They are respectively The generator. Define one or more collision-resistant hash functions, such as... .

[0044] (2) Threshold Key Generation Unit: This unit is responsible for generating the threshold key for... Each signer generates a threshold BLS key. During the initialization phase, a distributed key generation (DKG) protocol, such as Shamir's secret sharing protocol, is generated. A polynomial of order 1, whose master private key is (Constant term), the master public key is The first in the system Signers ( Obtain a share of private key (polynomial in) (value at the location) and the corresponding public key share .

[0045] (3) Attribute-based multi-authoritative accountability authorization unit: This unit is responsible for establishing an access control mechanism that is “legally accountable” and is an important part of the governance architecture of this invention.

[0046] ElGamal key: The system generates a pair of EC-ElGamal key pairs ( ),in Public key The private key is made public to all signers and is used to encrypt signature shares. The key must be strictly protected in order to be tracked.

[0047] Multi-Authority Attribute-Based Encryption (MA-ABE): The system establishes k independent attribute authorities (AAs) (e.g., AA1 = Legal Department, AA2 = Technical Department, AA3 = Regulatory Department), each authority... Generate your own MA-ABE public / private key pair ( ).

[0048] KEM / DEM key encapsulation: to achieve... For flexible access control, this invention employs a key encapsulation mechanism (KEM / DEM). First, a one-time symmetric key is generated. (For example, by hashing a random) Element M obtains Next, use right Perform authentication encryption (such as AES-GCM) to obtain ciphertext. Then, define an accountability access strategy. (For example Finally, using the MA-ABE scheme, in the strategy... Encryption Obtain the ABE ciphertext Publicly released As a "tracking key package".

[0049] As one implementation method in this embodiment, the process by which the signer generates the cryptographic share and zero-knowledge proof includes: The signer calculates the message hash and generates a BLS signature share using the threshold signature private key share. The BLS signature share is encrypted using EC-ElGamal encryption with the accountability public key and a random number to obtain the encrypted share. Construct witness values ​​and public statements for zero-knowledge proofs, and generate non-interactive zero-knowledge proofs to prove that the cryptographic share corresponds to a legitimate signature share.

[0050] The specific content includes signature share encryption and proof unit: (4) Signature Share Encryption and Proof Unit: This unit is executed by each signer i who participated in the signing. For the message m to be signed: Calculate the share: signer Use its private key share Calculate BLS signature shares .

[0051] Cryptographic Shares: Signer Use the tracker's public key Choose a random number ,right EC-ElGamal encryption is performed to obtain the ciphertext. .

[0052] Generating NIZK proofs: to convince the combiner The ciphertext is correct and requires no decryption, signer Generate a non-interactive zero-knowledge proof This proof Used to confirm that they knew about the private witness. This makes all public values Satisfying Relationship: Ciphertext The plaintext is indeed equal to a certain public key. BLS signature share .

[0053]

[0054] As one implementation method in this embodiment, the combiner verification and aggregation process includes: The combiner verifies the validity of zero-knowledge proofs in batches based on the signer's public key; Calculate the Lagrange interpolation coefficients for threshold signature aggregation; By leveraging the homomorphic properties of EC-ElGamal, scalar multiplication and addition operations are performed on the encrypted shares to generate aggregated ciphertext of constant size; Construct a participant commitment vector, where each element is an encryption of the participant token or zero element.

[0055] The specific process includes a combiner aggregation unit: (5) Combiner Aggregation Unit: This unit is executed by the combiner, which is publicly elected and authorized by the blockchain smart contract in the current round. The combiner is assumed to be honest but curious; it will faithfully execute the protocol but may attempt to snoop on plaintext signature shares to speculate on key privacy or unauthorized reuse. This unit performs the following steps: NIZK Batch Verification: Combiner Collection One (or more) from the set of signers of Package. Combiner according to table lookup Then batch verify all .like If verification fails, the share will be rejected.

[0056] Calculate the Lagrange coefficients: The combiner calculates the Lagrange coefficients based on the set of verified signers. , for each Calculate the Lagrange interpolation coefficients .

[0057] Ciphertext Homomorphic Aggregation: Utilizing the addition and scalar multiplication homomorphisms of EC-ElGamal, the combiner computes aggregated ciphertext in the ciphertext domain. This process requires no decryption, which is the core efficiency advantage of this invention. According to the homomorphic property, This is a valid EC-ElGamal ciphertext for the final threshold signature.

[0058] Participant commitment generation: To prevent the combiner from falsely reporting the number of participants during accountability. The combiner must also generate a "signature commitment vector". . It is a collection A vector of ciphertext ,in It refers to "participation markers" (such as a fixed one). element ) or ElGamal encryption of "zero elements" (also using (Encryption). If Then encrypt the "participation token"; if Then the "zero element" is encrypted.

[0059]

[0060] As one implementation method in this embodiment, the process of storing the hash digest of the aggregated ciphertext and the signatory commitment vector into the blockchain includes: The combiner invokes the blockchain smart contract to write the message, the aggregated ciphertext, the hash value of the signature commitment vector, and the combiner's system signature into the blockchain ledger; The smart contract records the hash value and the system signature of the combiner, forming an immutable audit trail.

[0061] The specific process includes on-chain evidence storage and governance units: (6) On-chain evidence storage and governance unit: This unit introduces blockchain as a decentralized root of trust and audit log.

[0062] Governance (Election): The blockchain smart contract (hereinafter referred to as ATAPSLogger) maintains a "combiner candidate set" and a "tracker candidate set". When an authorized task is initiated, the contract can specify the combiner for that round through consensus (such as random selection) to ensure the neutrality of the roles.

[0063] Evidence Storage (Anchoring): After aggregation, the combiner executes the principle of "off-chain computation, on-chain evidence storage." It calls the ATAPSLogger contract to write a summary of the key credentials into the blockchain ledger, for example: And attach your own system signature. Original and Stored off-chain (e.g., in a distributed storage system).

[0064] As one implementation method in this embodiment, the process of authorized trackers decrypting and verifying includes: The tracker requests attribute keys from multiple attribute authorities and uses these attribute keys to decrypt the tracking key packet in order to recover the accountability private key. Use the accountability private key to decrypt the aggregated ciphertext to obtain the threshold signature, and decrypt the signatory commitment vector to obtain the participant set; Verify the cryptographic correctness of the threshold signature and cross-validate the consistency between the participant set and the threshold signature.

[0065] The specific process includes an authorization tracking and auditing unit: (7) Authorization Tracking and Audit Unit: This stage is only initiated when accountability is required.

[0066] Obtaining authorization: The authorized tracker... Each attribute authority (AA) requests its respective attribute key. Authoritative agencies are only responsible for verifying the legitimacy of the trackers' identities and the authorization policies. Once the verification is approved, it will be issued in one go. The authoritative organization does not participate in any subsequent online calculations.

[0067] Recovery of the Tracking Private Key: The tracker collects all the attribute keys that satisfy policy P, decrypts the "tracking key package," and recovers the tracking private key. .

[0068] Batch decryption: The tracker obtains the digest from on-chain and from off-chain. and Original image. Use For a single Decrypt and recover the final threshold signature. Use Decryption To restore the actual set of participants .

[0069] Cross-validation: used by trackers In Independent recalculation and with the records on the chain (If recorded) a comparison is performed to confirm whether the decrypted threshold signature plaintext can be verified using the public key. This ensures that the combiner has not given a false report.

[0070] Evidence storage: The tracker submits the verification results to the ATAPSLogger contract to complete the audit loop.

[0071]

[0072] This invention adopts an "off-chain cryptographic execution + on-chain governance and evidence storage" architecture. Its core idea is to deeply integrate the authorization layer and the blockchain governance layer, which are structured around two main lines: "privacy threshold signature + traceable decryption." Cryptographic technology is used to achieve privacy protection for authorization, and blockchain technology is combined to achieve decentralized trusted governance and post-event accountability. This architecture mainly includes the following two core structures: (1) Authorization and Signature Structure: like Figure 1 As shown, this architecture is responsible for system initialization and the normal authorization and signature process. Its responsibilities primarily include system pre-computation and setup: access control policies are jointly developed and announced by the Multi-Authority Attributes Organization (MA-ABE). Its policy hash; simultaneously, a "tracking key package" containing the tracking public key is generated and published through a key encapsulation mechanism (KEM / DEM). ABE ciphertext Symmetric encryption ciphertext and strategies Components such as... During the signature execution phase, this structure defines the production chain of threshold signatures: First, the signers... Regarding the message Calculate its BLS share Next, use the tracking public key. This share EC-ElGamal encryption is performed to obtain the ciphertext. Simultaneously, the signer generates a non-interactive zero-knowledge proof. Used for binding The correctness of the relationship. Subsequently, the combiner collects... And it is verified. After the verification is passed, it is based on the Lagrange coefficients. Performing homomorphic aggregation on the ciphertext field yields an aggregated ciphertext of constant size. The combiner is also responsible for generating an encrypted signature commitment vector. Finally and The digest is anchored on-chain for evidence storage. The boundary of this structure is that it does not output any plaintext signature shares or track private key information during operation; it only exposes the aggregated ciphertext. Commitment Vector and its abstract.

[0073] (2) Tracking and auditing structure: like Figure 2 As shown, this structure is responsible for executing a controlled accountability process in the event of a dispute or compliance audit. Its responsibility begins with "authorization to unblock": the authorized tracer first follows a pre-defined strategy. Apply for and obtain attribute keys from multiple attribute authorities; use these keys to decrypt and trace the key packet. To recover the symmetric key to decrypt Obtain the final tracking private key .get Then, the tracker performs "batch decryption and cross-validation": using For off-chain storage Decryption is performed to recover the final threshold signature. Simultaneously decrypt the commitment vector To restore the visa application group Subsequently, the trackers... The effectiveness and and The consistency between them is cross-validated. Finally, this structure is responsible for "auditing on-chain": the tracer will generate an audit record (AuditRecord) containing... The verification status and related evidence hashes are written to an on-chain smart contract to support dispute periods and subsequent reviews. The boundary of this structure lies in tracking the private key. It can only be unblocked and used under authorized circumstances, and the accountability process will not disclose any plaintext information of the signature share.

[0074] like Figure 3 As shown, this example distinguishes several core participating entities in its architecture: signers, combiners, multiple authorities, the blockchain, trackers, and the public. The diagram uses different types of arrows to differentiate the "main multi-party authorization process" (privacy signing and accountability), "secure channel transmission" (encrypted data), and "blockchain-related operations" (governance and evidence preservation), collectively demonstrating the two core closed loops of this invention: 1) Normal Signing and On-Chain Process: In the normal signing process, the signer submits their encrypted share / proof to the combiner via a secure channel. The combiner's qualification is confirmed by the blockchain through role election, and it is responsible for verifying and aggregating the ciphertext. After aggregation, the combiner, on the one hand, stores the key credentials on the blockchain, and on the other hand, issues a system signature and releases public materials for public verification.

[0075] 2) On-demand accountability process: When accountability needs to be initiated, multiple authoritative institutions act as passive participants, issuing tracking materials to the trackers after verifying their permissions. The trackers use these materials (such as the decrypted and recovered tracking private key) to decrypt off-chain data to recover the set of signers, identify the real participants, and verify the results.

[0076] This example visually illustrates several key architectural features of the present invention: Separation of roles: Signature, aggregation, accountability, auditing, and governance responsibilities are clearly separated by different entities; Passive authority: Multiple authorities only participate in the initial key issuance and low-frequency accountability authorization of materials, without intervening in the high-frequency signature aggregation process, which significantly reduces the coordination costs of the authorities. On-chain governance and evidence storage: The blockchain acts as a decentralized root of trust, responsible for electing neutral roles and storing key credentials on the chain, supporting an audit architecture of "off-chain computation and on-chain evidence storage".

[0077] As an optional implementation method in this embodiment, the current scheme selects EC-ElGamal encryption because of its pairing group It has good compatibility with BLS signatures. As an alternative, other additive homomorphic encryption schemes can be used, such as Paillier encryption. Paillier operates on the integer ring. Even after the replacement, it is still necessary to adapt to the BLS group structure through methods such as zero-knowledge proofs in order to complete the aggregation of encrypted shares.

[0078] As an optional implementation in this embodiment, the current scheme employs the Fiat–Shamir heuristic non-interactive zero-knowledge proof (NIZK). Alternatively, other more general zero-knowledge proof systems, such as zk-SNARKs (e.g., Groth16), can also be used. zk-SNARKs are proof systems that do not require a trusted setup and can provide short proof sizes. All of these schemes can be used to prove the correctness of cryptographic shares.

[0079] As an optional implementation method in this embodiment, the current scheme uses multi-authority attribute-based encryption to achieve flexible, passive accountability authorization. Alternatively, a threshold decryption mechanism can be used. In this way, the tracking private key can be distributed to multiple authoritative bodies through methods such as Shamir secret sharing, achieving multi-party co-management of the tracking private key.

[0080] As an optional implementation in this embodiment, the current solution uses a blockchain as a decentralized root of trust for role election and log storage. Alternatively, it can rely on a centralized, trusted log server instead of a blockchain. For example, a tamper-resistant log server built on MerkleTree can be used to replace the blockchain and perform the function of storing key credentials.

[0081] As an optional implementation in this embodiment, the current scheme uses standard "hybrid encryption" (KEM / DEM), which involves encrypting a symmetric key using an attribute-based cryptography algorithm, and then using that symmetric key to encrypt the tracking private key. Alternatively, a "key derivation" method can be used: the system can be configured so that the tracking private key itself is calculated from a "master seed" using a publicly available derivation function (such as a hash function). The core task of the attribute-based cryptography algorithm is no longer to encrypt the tracking private key, but rather to encrypt and protect this "master seed." After decrypting and obtaining this "master seed," the tracker can derive the actual tracking private key through local computation.

[0082] Based on this, the present invention provides an efficient multi-authority accountability and multi-party authorization method based on attribute encryption. Compared with the prior art, the present invention has the following technical effects: 1) Stronger privacy protection and lower threat level: This invention achieves cryptographic privacy protection at the combiner level by introducing EC-ElGamal encryption and Non-Interactive Zero-Knowledge Proof (NIZK) technology, enabling the combiner to operate entirely within the ciphertext domain. The combiner can verify the correctness of encrypted shares using NIZK, but cannot decrypt to obtain any plaintext shares. This achieves cryptographic invisibility of shares to the combiner, avoiding the problem of the combiner directly accessing plaintext shares in previous schemes, and also mitigating the side-channel attacks or hardware vulnerability threats that might be introduced by the reliance on TEE hardware in previous schemes.

[0083] 2) Faster computational efficiency and higher scalability: Existing schemes based on encrypted shares do not support ciphertext aggregation, resulting in storage and accountability overhead being O(t) linearly related to the number of participants, *t*. This invention utilizes the homomorphic aggregation property of EC-ElGamal, enabling the combiner to aggregate *t* encrypted shares into a single, constant-size aggregated ciphertext. When pursuing accountability, the tracer only needs to perform a single decryption operation on this aggregated ciphertext to recover the final threshold signature. This makes both aggregation storage overhead and accountability decryption overhead constant at O(1), demonstrating significant efficiency advantages and excellent scalability in large-scale distributed application scenarios.

[0084] 3) Robust governance structure and flexible strategies: This invention introduces a Multi-Authority Attribute-Based Encryption (MA-ABE) mechanism, distributing accountability (i.e., the right to decrypt the private key) to multiple independent attribute authorities (such as legal departments, technical departments, etc.). The tracer must meet preset attribute policies (e.g., "legal department AND (technical department OR regulatory department)") to recover the key and execute accountability. This avoids the centralized trust model and single point of failure problems of traditional schemes that rely on a single tracer, while providing more flexible and granular access control capabilities than fixed-threshold decryption.

[0085] 4) Greater applicability and lower system coordination costs: Existing solutions require authoritative institutions (notaries) to be online for extended periods and participate in complex cryptographic interactions, resulting in high participation costs and limited engineering feasibility. A key feature of this invention is that the authoritative institution adopts a passive participation model during system operation. Its primary responsibility is to issue attribute keys to authorized trackers in a one-time manner according to governance regulations. High-frequency or computationally intensive operations such as signing, aggregation, verification, and accountability decryption are all performed independently by the trackers locally, without requiring real-time online participation from the authoritative institution. This significantly reduces the participation cost for the authoritative institution and the complexity of cross-domain coordination within the system, better aligning with the actual operational model of regulatory agencies as policymakers and post-auditors.

[0086] 5) Provides lightweight, tamper-proof audit support: This invention follows the design principle of "off-chain computation and on-chain evidence storage," utilizing the immutability of blockchain as a decentralized root of trust. Cryptographic digests of key operations are anchored to the blockchain, forming a globally consistent and publicly verifiable lightweight audit trail. This facilitates post-event auditing and dispute resolution while avoiding the storage burden and privacy risks associated with storing large amounts of raw data on the blockchain, achieving efficient evidence storage while ensuring compliance.

[0087] This invention constructs an accountability architecture based on Multi-Authority Attribute-Based Encryption (MA-ABE). The main contribution of this invention is this "passive authority" accountability architecture. At its core, the master tracer's private key is protected by symmetric key encryption via Key Encapsulation (KEM). This symmetric key is then encrypted using a Multi-Authority Attribute-Based Encryption (MA-ABE) scheme and bound to an access policy involving multiple authoritative bodies. The authoritative bodies play only a "passive" role, responsible for issuing attribute keys once, without needing to participate online. Once the authorized tracer has collected all the attribute keys locally and met the policy requirements, they can independently decrypt the master tracer's private key and perform a single decryption of the aggregated ciphertext of constant size to complete the accountability process. This design avoids the centralized trust risk of a single tracer and the high online load problem of authoritative bodies.

[0088] In addition, this invention constructs a privacy protection mechanism for ciphertext aggregation signature shares based on homomorphic encryption. This is another contribution of this invention, realizing a ciphertext domain aggregation mechanism that protects the privacy of the combiner at the cryptographic level. The signer encrypts their signature share using a cryptographic algorithm that supports semi-homomorphic encryption to obtain a ciphertext share and generates a non-interactive zero-knowledge proof (NIZK). This NIZK proof is used to verify the correctness of the encrypted share to the combiner without revealing the plaintext share or the signer's private key. The combiner operates only in the ciphertext domain, first verifying the NIZK proof, and then using homomorphic properties (addition and scalar multiplication) to aggregate all valid encrypted shares. Finally, a single, constant-size aggregated ciphertext is generated, achieving constant-level aggregation efficiency and cryptographic privacy protection for the combiner.

[0089] Example 2 In this embodiment, a computer terminal device is provided, including: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the above-described efficient multi-authority accountability and multi-party authorization method based on attribute encryption.

[0090] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the above-described efficient multi-authority accountability and multi-party authorization method based on attribute encryption.

[0091] In this embodiment, an electronic device is also provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the above-described efficient multi-authority accountability and multi-party authorization method based on attribute encryption.

[0092] In this embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the above-described efficient multi-authority accountability and multi-party authorization method based on attribute encryption.

[0093] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0094] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented by different modules for different steps.

[0095] This embodiment provides such a device or system. The device, described as a high-efficiency multi-authority accountability and multi-party authorization device based on attribute encryption, includes: The initialization module is used to generate threshold signature keys and accountability keys, wherein the accountability private key is encrypted and protected by a multi-authority attribute base encryption mechanism and a preset access policy. The signature processing module enables the signer to generate a signature share for the message using the threshold signature private key share, encrypt the signature share using the accountability public key to obtain the encrypted share, and generate a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share. The aggregation processing module is used to enable the combiner to collect encrypted shares and zero-knowledge proofs, verify the zero-knowledge proofs, aggregate the encrypted shares into aggregated ciphertext using homomorphic encryption properties, and generate a sign-off commitment vector. The evidence storage module is used to store the hash digest of the aggregated ciphertext and the signatory commitment vector to the blockchain; The accountability processing module enables authorized trackers to obtain attribute keys from attribute authorities, decrypt and recover the accountability private key, use the accountability private key to decrypt the aggregated ciphertext to recover the threshold signature, and verify the consistency between the threshold signature and the participant set.

[0096] As one implementation method in this embodiment, the initialization module includes: The key generation unit is used to generate threshold BLS signature key pairs, including a master public key and a share of a private key. The accountability key generation unit is used to generate EC-ElGamal accountability key pairs, including an accountability public key and an accountability private key; The encryption protection unit is used to encrypt the accountability private key using a multi-authority attribute-based encryption mechanism through key encapsulation. The symmetric key is encrypted by the multi-authority attribute-based encryption scheme and bound to the access policy to form a tracking key package.

[0097] As one implementation method in this embodiment, the signature processing module includes: The signature share generation unit is used to enable the signer to calculate the message hash value and generate a BLS signature share using the threshold signature private key share; The encryption unit is used to enable the signer to use the accountability public key and a random number to perform EC-ElGamal encryption on the BLS signature share to obtain the encrypted share; The proof generation unit enables the signer to construct a witness value and a public statement for a zero-knowledge proof, generating a non-interactive zero-knowledge proof to prove that the cryptographic share corresponds to a legitimate signature share.

[0098] As one implementation method in this embodiment, the aggregation processing module includes: The verification unit enables the combiner to batch verify the validity of zero-knowledge proofs based on the signer's public key; The coefficient calculation unit is used to calculate the Lagrange interpolation coefficients for threshold signature aggregation. The homomorphic aggregation unit is used to perform scalar multiplication and addition operations on encrypted shares using the homomorphic properties of EC-ElGamal to generate aggregated ciphertext of constant size; The commitment generation unit is used to construct the participant commitment vector, where each element is an encryption of the participation token or zero element.

[0099] As one implementation method in this embodiment, the evidence storage module includes: The hash calculation unit is used to calculate the hash value of the message, aggregated ciphertext, and signature commitment vector; The blockchain interaction unit is used to call the blockchain smart contract and write the hash value into the blockchain ledger. The audit trail generation unit is used to record the hash value and the system signature of the combiner to form an unalterable audit trail.

[0100] As one implementation method in this embodiment, the accountability processing module includes: The attribute key acquisition unit enables trackers to request attribute keys from multiple attribute authorities; The accountability private key recovery unit is used to decrypt the tracking key packet using the attribute key to recover the accountability private key; The decryption unit is used to decrypt the aggregated ciphertext using the accountability private key to obtain the threshold signature, and to decrypt the signatory commitment vector to obtain the participant set; The verification unit is used to verify the cryptographic correctness of the threshold signature and to cross-verify the consistency between the participant set and the threshold signature.

[0101] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0102] The above implementation method solves the problem of efficient multi-authority accountability and multi-party authorization based on attribute encryption in related technologies, thereby ensuring that the problems existing in the prior art are resolved.

[0103] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A highly efficient multi-authority accountability and multi-party authorization method based on attribute encryption, characterized in that, Includes the following steps: Initialize the system and generate a threshold signature key and an accountability key, wherein the accountability private key is encrypted and protected by a multi-authority attribute base encryption mechanism and a preset access policy. The signer uses the threshold signature private key share to generate a signature share for the message, uses the accountability public key to encrypt the signature share to obtain an encrypted share, and generates a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share; The combiner collects encrypted shares and zero-knowledge proofs, verifies the zero-knowledge proofs, and then uses homomorphic encryption to aggregate the encrypted shares into aggregate ciphertext. The combiner generates a signature commitment vector and stores the hash digest of the aggregated ciphertext and the signature commitment vector into the blockchain; The authorized tracker obtains the attribute key from the attribute authority, decrypts and recovers the accountability private key, uses the accountability private key to decrypt the aggregate ciphertext to recover the threshold signature, and verifies the consistency of the threshold signature with the participant set.

2. The method according to claim 1, characterized in that, The system initialization process includes: Generate a threshold BLS signature key pair, including the master public key and private key share; Generate an EC-ElGamal accountability key pair, including an accountability public key and an accountability private key; The accountability private key is encrypted using a multi-authority attribute-based encryption mechanism and is bound to the access policy to form a tracking key package.

3. The method according to claim 1, characterized in that, The process by which the signer generates the cryptographic share and zero-knowledge proof includes: The signer calculates the message hash and generates a BLS signature share using the threshold signature private key share. The BLS signature share is encrypted using EC-ElGamal encryption with the accountability public key and a random number to obtain the encrypted share. Construct witness values ​​and public statements for zero-knowledge proofs, and generate non-interactive zero-knowledge proofs to prove that the cryptographic share corresponds to a legitimate signature share.

4. The method according to claim 1, characterized in that, The process of combiner validation and aggregation includes: The combiner verifies the validity of zero-knowledge proofs in batches based on the signer's public key; Calculate the Lagrange interpolation coefficients for threshold signature aggregation; By leveraging the homomorphic properties of EC-ElGamal, scalar multiplication and addition operations are performed on the encrypted shares to generate aggregated ciphertext of constant size; Construct a participant commitment vector, where each element is an encryption of the participant token or zero element.

5. The method according to claim 1, characterized in that, The process of storing the hash digest of the aggregated ciphertext and the signatory commitment vector into the blockchain includes: The combiner invokes the blockchain smart contract to write the hash values ​​of the message, aggregated ciphertext, and signature commitment vector into the blockchain ledger; The smart contract records the hash value and the system signature of the combiner, forming an immutable audit trail.

6. The method according to claim 1, characterized in that, The authorized tracker's decryption and verification process includes: The tracker requests attribute keys from multiple attribute authorities and uses these attribute keys to decrypt the tracking key packet in order to recover the accountability private key. Use the accountability private key to decrypt the aggregated ciphertext to obtain the threshold signature, and decrypt the signatory commitment vector to obtain the participant set; Verify the cryptographic correctness of the threshold signature and cross-validate the consistency between the participant set and the threshold signature.

7. A highly efficient multi-authority accountability and multi-party authorization device based on attribute encryption, characterized in that, The apparatus for implementing the method according to any one of claims 1-6 comprises: The initialization module is used to generate threshold signature keys and accountability keys, wherein the accountability private key is encrypted and protected by a multi-authority attribute base encryption mechanism and a preset access policy. The signature processing module enables the signer to generate a signature share for the message using the threshold signature private key share, encrypt the signature share using the accountability public key to obtain the encrypted share, and generate a non-interactive zero-knowledge proof to verify the correspondence between the encrypted share and the signature share. The aggregation processing module is used to enable the combiner to collect encrypted shares and zero-knowledge proofs, verify the zero-knowledge proofs, aggregate the encrypted shares into aggregated ciphertext using homomorphic encryption properties, and generate a sign-off commitment vector. The evidence storage module is used to store the hash digest of the aggregated ciphertext and the signatory commitment vector to the blockchain; The accountability processing module enables authorized trackers to obtain attribute keys from attribute authorities, decrypt and recover the accountability private key, use the accountability private key to decrypt the aggregated ciphertext to recover the threshold signature, and verify the consistency between the threshold signature and the participant set.

8. A computer terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors perform the steps of the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

Images