General aggregation signature method and system based on partial aggregation

Abstract

The invention relates to a general aggregation signature method and system based on partial aggregation, and the method comprises the following steps: 1, the system executes an initialization algorithm to generate a public parameter, and a user and an issuing party generate a key pair; 2, the issuing party generates a voucher for the user according to the voucher request of the user; 3, aggregating different certificates issued by the same issuer or aggregating different certificates of the same user according to an application scene and a verification demand to generate an aggregated certificate; 4, randomizing the aggregated signature, performing selective disclosure of the voucher in combination with zero-knowledge proof according to an actual demand, generating a presentation voucher, and sending the voucher to a verification party; and step 5, the verification party carries out validity verification on the aggregation signature and the zero-knowledge proof in the presentation voucher. According to the invention, the aggregation limitation is small, the verification efficiency can be improved and the communication cost can be reduced while the sensitive information is protected, and the system has higher performance in the aspect of execution.

Description

Technical Field

[0001] This invention belongs to the field of digital signature technology, specifically relating to a general aggregation signature method and system based on partial aggregation. Background Technology

[0002] With the rapid development of internet technology, online life has become an integral part of human society. Identity authentication technology, a core component of network information security, ensures the legitimacy of service access by verifying the identity credentials provided by users. Anonymous credentials, in particular, have attracted widespread attention due to their unique privacy protection capabilities. This technology allows users to prove they possess valid credentials without disclosing their identity information, and each credential usage record is unlinkable, thereby preventing long-term tracking and correlation analysis of behavioral data.

[0003] Because anonymous credential systems require credentials to be unforgeable, existing systems are typically constructed based on existing signature schemes. The issuer signs a user's attribute set to generate a credential, and the user selectively discloses attributes using zero-knowledge proofs when presenting it. However, with the increasing prevalence of multi-credential scenarios, existing anonymous credential systems face severe efficiency issues. As the number of entities participating in the signing increases, the multiple independent signatures generated by existing digital signature schemes not only consume significant storage space but also consume substantial bandwidth during network transmission. Furthermore, verifying multiple individual signatures is cumbersome and time-consuming, severely impacting the overall system performance and efficiency.

[0004] To address the aforementioned technical issues, many recent anonymous credential solutions have introduced aggregate signature technology. Aggregated signatures are smaller than the sum of individual signatures, yet can still be used to verify any individual signature message before aggregation. The main purpose of aggregate signatures is to save storage space and bandwidth while maintaining the same security level as individual signatures. Furthermore, verifying an aggregate signature takes less time than verifying the sum of the times of each individual signature within it, thus improving system performance. However, existing aggregate signature solutions are not fully applicable to multi-credential presentation scenarios and face certain constraints in dynamic multi-credential scenarios. For example, they can only aggregate signatures with the same time or tag. Deployment costs are high and flexibility is poor in open systems, severely limiting application scenarios and failing to meet diverse information security needs. For instance, existing anonymous credential solutions cannot simultaneously adapt to both "cross-organizational collaboration" and "single-organizational batch processing" core business scenarios, nor can they cover hybrid scenarios that simultaneously include cross-organizational collaboration and single-organizational internal batch management needs, thus restricting the practicality of anonymous credential systems. Clearly, existing aggregated signature schemes are not suitable for dynamic and flexible environments due to their constraints. For example, the AtoSa aggregated signature scheme based on PS signatures proposed by Mir et al. in their paper "Aggregate Signatures with Versatile Randomization and Issuer-Hiding Multi-Authority Anonymous Credentials" presented at the 30th ACM Conference on Computer and Communications Security in 2023 is a signature scheme that supports tag-binding aggregation, public key randomization, and tag randomization. This aggregated signature scheme can only aggregate signatures when all signatures are associated with the same tag. It also supports aggregating signatures from different issuers into a single credential and signature randomization. It is evident that this scheme still has the following technical shortcomings, specifically: due to the aforementioned aggregation constraints, it faces obstacles to dynamic expansion; adding an issuer requires reconstructing the tag, making it unsuitable for open systems, and increasing deployment costs in dynamic environments, resulting in poor practicality; furthermore, this scheme only supports the aggregation of signatures from different issuers, not the aggregation of different signatures from the same issuer, thus failing to leverage its aggregation advantages in centralized systems.

[0005] Chinese invention publication CN120433946A discloses a quantum-safe aggregation signature method suitable for embedded systems. The method initializes system parameters through a trusted key generation center, generating a public-private key pair for each signing user. Each user signs a message using a signature algorithm and their private key, sending the generated signature, the message, and their respective digital certificates to an aggregation server. The aggregation server, based on the received information, executes an aggregation algorithm to merge multiple signatures into a single aggregate signature, sending the aggregate signature and related information to a verification server. The verification server verifies the aggregate signature using the system parameters provided by the trusted key generation center and the aggregation server's public key, ensuring the integrity and correctness of the signature, thereby verifying the message's origin and availability. This method is suitable for various embedded systems with numerous edge nodes and limited computing resources, such as secure communication in drone swarms, secure communication for medical wireless sensors, intelligent connected vehicles, and even secure satellite communication. However, this invention is a synchronous aggregation signature method and includes a timestamp parameter, indicating a requirement for signature generation time; only signatures within a specific time frame can be aggregated, thus limiting the scheme's versatility. Furthermore, this invention only supports the aggregation of signatures from different issuers, thus further limiting its versatility. Summary of the Invention

[0006] To address the efficiency issues of existing anonymous credential systems in scenarios involving multiple credential presentations, while simultaneously reducing the constraints of signature aggregation and improving the practicality of aggregated signature schemes, it is crucial and meaningful to design a general aggregated signature method and develop an anonymous credential system with higher performance, lower storage overhead, and lower communication consumption. Accordingly, this invention employs a partial aggregation approach to design a general aggregated signature method. Specifically, when aggregating multiple signatures from one or more signers, the entire signature is not aggregated. Taking the PS signature as an example, only the second signature element of multiple signatures is aggregated to generate a single aggregated signature element, while the first signature element remains independent. The anonymous credential system scheme designed using this general aggregated signature scheme based on partial aggregation and a zero-knowledge proof protocol supports credential randomization and selective disclosure of attributes.

[0007] This invention provides a general aggregation signature method based on partial aggregation, comprising the following steps: Step 1: The system executes the initialization algorithm to generate common parameters, and the user and issuer generate key pairs; Step 2: The issuer generates credentials for the user based on the user's credential request; Step 3: Based on the application scenario and verification requirements, partially aggregate different credentials issued by the same issuer or different credentials issued by the same user to generate aggregated credentials; Step 4: Randomize the aggregate signature and selectively disclose the credentials based on actual needs and zero-knowledge proofs, generate the presentation credentials, and send the credentials to the verifier; Step 5: The verifier verifies the validity of the aggregate signature and zero-knowledge proof in the presented credentials.

[0008] The general aggregate signature refers to the ability to combine signatures from multiple different users on different messages into a single signature. Specifically, each user... You will receive a signed message signature Anyone can use a publicly available aggregation algorithm to... n Signature Compressed into a single signature Meanwhile, anyone can use the aggregate signature verification algorithm to determine whether the aggregate signature is valid.

[0009] The aforementioned partial aggregation refers to the aggregation of signature elements for the example PS signature. For Do not aggregate, only aggregate Finally, output the aggregate signature of the second element of the signature. .

[0010] The anonymous credential system refers to a system that achieves a balance between privacy protection and identity verification through cryptographic technologies (such as zero-knowledge proofs and digital signatures). When a user proves that they possess a certain credential (such as identity attributes and permissions), they do not need to disclose irrelevant information, but only demonstrate the validity of the credential, and the verifier cannot associate it with the user's behavior in different scenarios. The anonymous credential system involves three parties: the issuer (issuance), the user (use), and the verifier (confirmation), which can ensure the authenticity and non-forgeability of the credential, and is mainly used in scenarios such as digital identity.

[0011] Further, step 1 includes the following steps: Step 1.1: Input security parameters k Generate common parameters ,in: Here, a third type of bilinear mapping is used, and Three prime numbers Cyclic groups of order 1 It is a non-degenerate, computationally efficient bilinear mapping; The In the parameters: It is a large prime number; Three prime numbers Cyclic groups of order 1; It is a bilinear mapping function. for Generators of a group for Generators of a group; Step 1.2: First, define: In the formula: and They are respectively The unit element of a group; for The remaining elements in the group excluding the identity element; for The remaining elements in the group excluding the identity element; Next, a key pair is generated for the issuer, and a random selection is made. ,calculate Set the issuer's private key to The public key is ; The random selection For from set Randomly select elements From Randomly select elements The for A group of integers of order 1.

[0012] Furthermore, step 2 includes the following steps: Step 2.1: The user sends a credential request to the issuer, where the user's attributes are specified. Defined into three types: attribute values ​​known to the issuer or attribute values ​​jointly determined. A k A promise to obtain an attribute value that the issuer does not know but which is unknown to the issuer. A h Attribute values ​​that are completely hidden from the issuer A c And define the corresponding indexes as follows: Because this invention supports hiding attributes from the issuer, it can improve the privacy capabilities of this general aggregate signature method. Step 2.2: The user calculates the commitment value of the commitment attribute, the expression value of the commitment attribute and the hidden attribute, and generates the relevant zero-knowledge proof. ,in All are random numbers: ; In the formula: NIZK This is a non-interactive zero-knowledge proof; For user attributes; for Random numbers in a group; A h A collection of hidden attributes; AcFor the set of commitment attributes; U For expression; g for Group generator; Y i For the issuer's public key; C i For each commitment attribute; h i for Random numbers in the data; I c For the set of promised attribute indexes; I h A collection of hidden attribute indexes; Step 2.3: The user will use zero-knowledge proofs Send to the issuer; Step 2.4: The issuer first verifies the zero-knowledge proof. Perform verification; if verification passes, generate a signature for all user attributes. and send the signature to the user; In the formula: u for Random numbers in a group; A signature generated by the issuer; for Group generator; X The issuer's private key; U Expressions sent to users; I k A collection of indexes for public attributes; Y i The issuing public key; For user attributes; Step 2.5: The user deblinds the signature. The verification algorithm is used to confirm the credentials; if the equation holds true, the credentials are stored. ; In the formula: e It is a bilinear mapping function; For signature The first element; For computation of zero-knowledge proofs Generated at time Random numbers in a group; The issuing public key; The issuing public key; For user attributes; For signature The second element; for Group generator.

[0013] Furthermore, step 3 includes the following steps: Step 3.1: Based on the actual scenario requirements, [the following steps are taken / implemented]... A valid signature aggregation, It's a message. In public key The signatures below are only partially aggregated signatures; Step 3.2: For For Do not aggregate, only aggregate ,in: ; In the formula: This is a multiplication operation.

[0014] Furthermore, step 4 includes the following steps: Step 4.1: When a user presents their credentials, the access policy selectively discloses attributes to the verifier, setting the set of attributes to be displayed to the verifier as follows: The hidden attribute set is set to And define the corresponding indexes as follows: and ; Step 4.2: First, randomize the aggregate signature by randomly selecting... The randomized signature is Then generate a knowledge proof with the signature. Selective disclosure of attributes : ; ; In the formula: for Random numbers in a group; Number of signatures; A collection of indices for hidden attributes; The randomized signature element; For the first The issuer's public key; A set of indexes for disclosed attributes; For the first The first issuer A public key; For the first The first user's One attribute; for Random numbers in the data; For the first A commitment to a set of user attributes; For the first The user-generated number indivual Random numbers for a group; Step 4.3: The user constructs a presentation credential based on the credentials and the above proof, and sends the presentation credential to the verifier.

[0015] Furthermore, step 5 includes the following steps: Step 5.1: After receiving the presented voucher, the verifying party verifies the proof: First, enter the message. The first element of all signatures The aggregate signature of the second element. and public key Then, the aggregate signature is verified; Step 5.2: If the verification passes, provide the corresponding service to the user, that is: if If it is established, then Valid; otherwise, the signature is invalid. In the formula: This is a multiplication operation; Number of signatures; e It is a bilinear mapping function; For the first The issuer's public key; For the first The first issuer A public key, For the first The first user's One attribute, for Group generator.

[0016] To address the aforementioned problems in the prior art, the present invention also provides a general aggregation signature system based on partial aggregation, comprising: System initialization module: used to execute the initialization algorithm to generate common parameters, and for users and issuers to generate key pairs; The certificate issuance module is used by the issuer to generate certificates for users based on their certificate requests. The credential aggregation module is used to aggregate different credentials issued by the same issuer or different credentials issued by the same user, and generate aggregated credentials. The certificate generation and presentation module is used to randomize the aggregate signature and selectively disclose the certificate according to actual needs by combining zero-knowledge proofs, generate the certificate, and send the certificate to the verifier. Verify the presented credentials module: This module is used by the verifier to verify the validity of the aggregate signature and zero-knowledge proof in the presented credentials. The system initialization module is connected to the certificate issuance module, the certificate issuance module is connected to the certificate aggregation module, the certificate aggregation module is connected to the certificate generation and presentation module, and the certificate generation and presentation module is connected to the certificate verification and presentation module.

[0017] Furthermore, the general aggregated signature system is applicable to two aggregation scenarios. The first aggregation scenario refers to the ability to aggregate multiple different signatures signed by the same issuer. The second aggregation scenario refers to the ability to aggregate multiple signatures signed by multiple different issuers, and to achieve selective disclosure and non-linkability of the aggregated credentials.

[0018] Furthermore, the first aggregation scenario includes aggregating credentials for different users or credentials for the same user.

[0019] Furthermore, the second aggregation scenario includes aggregating different credentials for the same user or different credentials for different users.

[0020] This invention presents a general aggregation signature scheme based on a partial aggregation approach. It not only has fewer aggregation restrictions but also supports the simultaneous aggregation of credentials from different issuers and credentials from the same issuer. Furthermore, it supports the randomization and selective disclosure of aggregated credentials, thereby improving the efficiency of anonymous credential systems while protecting user privacy. This achieves the technical effect of further improving verification efficiency and reducing communication costs while protecting sensitive information. In addition, this invention can achieve credential aggregation while protecting user privacy, with lower storage overhead and communication consumption, resulting in higher system performance. This invention is applicable to fields that handle massive authentication, sensitive data exchange, and require the construction of a trusted collaborative ecosystem, and this cryptographic scheme can be integrated as a core engine into specific application software or service platforms. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the workflow of issuing and presenting user credentials in a preferred embodiment of the general aggregate signature method and system based on partial aggregation of the present invention. Figure 2 The flowchart of the general aggregate signature generation algorithm based on PS signature is shown in a preferred embodiment of the general aggregate signature method and system based on partial aggregation of the present invention. Figure 3 This is a flowchart of a general aggregate signature verification algorithm based on PS signature in a preferred embodiment of the general aggregate signature method and system based on partial aggregation of the present invention. Detailed Implementation

[0022] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0023] To address the aforementioned problems in the prior art, this invention provides a general aggregation signature method based on partial aggregation, such as... Figure 1 As shown, it includes the following steps: Step 1: The system executes the initialization algorithm to generate common parameters, and the user and issuer generate key pairs; Step 2: The issuer generates credentials for the user based on the user's credential request; Step 3: Based on the application scenario and verification requirements, partially aggregate different credentials issued by the same issuer or different credentials issued by the same user to generate aggregated credentials; Step 4: Randomize the aggregate signature and selectively disclose the credentials based on actual needs and zero-knowledge proofs, generate the presentation credentials, and send the credentials to the verifier; Step 5: The verifier verifies the validity of the aggregate signature and zero-knowledge proof in the presented credentials.

[0024] The general aggregate signature refers to the ability to combine signatures from multiple different users on different messages into a single signature. Specifically, each user... You will receive a signed message signature Anyone can use a publicly available aggregation algorithm to... n Signature Compressed into a single signature Meanwhile, anyone can use the aggregate signature verification algorithm to determine whether the aggregate signature is valid.

[0025] The partial aggregation refers to the signature elements of the example PS signature. For Do not aggregate, only aggregate Finally, output the aggregate signature of the second element of the signature. .

[0026] The anonymous credential system refers to a system that achieves a balance between privacy protection and identity verification through cryptographic technologies (such as zero-knowledge proofs and digital signatures). When a user proves that they possess a certain credential (such as identity attributes and permissions), they do not need to disclose irrelevant information, but only demonstrate the validity of the credential, and the verifier cannot associate it with the user's behavior in different scenarios. The anonymous credential system involves three parties: the issuer (issuance), the user (use), and the verifier (confirmation), which can ensure the authenticity and non-forgeability of the credential, and is mainly used in scenarios such as digital identity.

[0027] Optionally, such as Figure 2 As shown, step 1 includes the following steps: Step 1.1: Input security parameters k Generate common parameters ,in, Here, a third type of bilinear mapping is used, and Three prime numbers Cyclic groups of order 1 It is a non-degenerate, computationally efficient bilinear mapping; The In the parameters: It is a large prime number; Three prime numbers Cyclic groups of order 1; It is a bilinear mapping function. for Generators of a group for Generators of a group; Step 1.2: First, define: In the formula: and They are respectively The unit element of a group; for The remaining elements in the group excluding the identity element; for The remaining elements in the group excluding the identity element; Next, a key pair is generated for the issuer, and a random selection is made. ,calculate Set the issuer's private key to The public key is ; The random selection For from set Randomly select elements From Randomly select elements The for A group of integers of order 1.

[0028] Optionally, such as Figure 2 As shown, step 2 includes the following steps: Step 2.1: The user sends a credential request to the issuer, where the user's attributes are specified. Defined into three types: attribute values ​​known to the issuer or attribute values ​​jointly determined. A k A promise to obtain an attribute value that the issuer does not know but which is unknown to the issuer. A hAttribute values ​​that are completely hidden from the issuer A c And define the corresponding indexes as follows: Because this invention supports hiding attributes from the issuer, it can improve the privacy capabilities of this general aggregate signature method. Step 2.2: The user calculates the commitment value of the commitment attribute, the expression value of the commitment attribute and the hidden attribute, and generates the relevant zero-knowledge proof. ,in All are random numbers: ; In the formula: NIZK This is a non-interactive zero-knowledge proof; For user attributes; for Random numbers in a group; A h A collection of hidden attributes; Ac For the set of commitment attributes; U For expression; for Group generator; Y i For the issuer's public key; C i For each commitment attribute; h i for Random numbers in the data; I c For the set of promised attribute indexes; I h A collection of hidden attribute indexes; Step 2.3: The user will use zero-knowledge proofs Send to the issuer; Step 2.4: The issuer first verifies the zero-knowledge proof. Perform verification; if verification passes, generate a signature for all user attributes. and send the signature to the user; In the formula: u for Random numbers in a group; A signature generated by the issuer; g for Group generator; X The issuer's private key; U Expressions sent to users; I k A collection of indexes for public attributes; Y i The issuing public key; For user attributes; Step 2.5: The user deblinds the signature. The verification algorithm is used to confirm the credentials; if the equation holds true, the credentials are stored. ; In the formula: e It is a bilinear mapping function; For signature The first element; For computation of zero-knowledge proofs Generated at time Random numbers in a group; The issuing public key; The issuing public key; m i For user attributes; For signature The second element; for Group generator.

[0029] Optionally, such as Figure 2 As shown, step 3 includes the following steps: Step 3.1: Based on the actual scenario requirements, [the following steps are taken / implemented]... A valid signature aggregation, It's a message. In public key The signatures below are only partially aggregated signatures; Step 3.2: For For Do not aggregate, only aggregate ,in ; In the formula: This is a multiplication operation.

[0030] The following is combined Figure 2 Further explanation of the workflow of the general aggregate signature generation algorithm based on PS signature: First, the signer generates the key: randomly selected. ,calculate Output private key Public key ; Secondly, the signer signs the message set: randomly selected. Regarding the message Perform a signature and output a constant-size signature containing two elements. ;

[0031] Finally, aggregate signature: for A valid signature aggregation, It's a message. In public key The signature below only calculates a partial aggregate signature. For For Do not aggregate, only aggregate Output .

[0032] Optionally, step 4 includes the following steps: Step 4.1: When a user presents their credentials, the access policy selectively discloses attributes to the verifier, setting the set of attributes to be displayed to the verifier as follows: The hidden attribute set is set to And define the corresponding indexes as follows: and ; Step 4.2: First, randomize the aggregate signature by randomly selecting... The randomized signature is Then generate a knowledge proof with the signature. Selective disclosure of attributes : ; ; In the formula: for Random numbers in a group; Number of signatures; A collection of indices for hidden attributes; The randomized signature element; For the first The issuer's public key; A set of indexes for disclosed attributes; For the first The first issuer A public key; For the first The first user's One attribute; for Random numbers in the data; For the first A commitment to a set of user attributes; For the first The user-generated number indivual Random numbers for a group; Step 4.3: The user constructs a presentation credential based on the credentials and the above proof, and sends the presentation credential to the verifier.

[0033] Optionally, such as Figure 3 As shown, the general aggregate signature verification algorithm based on PS signature, i.e., step 5, includes the following steps: Step 5.1: After receiving the presented voucher, the verifying party verifies the proof: First, enter the message. The first element of all signatures The aggregate signature of the second element. and public key Then, the aggregate signature is verified; Step 5.2: If the verification passes, provide the corresponding service to the user, that is: if If it is established, then Valid; otherwise, the signature is invalid. In the formula: This is a multiplication operation; Number of signatures; e It is a bilinear mapping function; For the first The issuer's public key; For the first The first issuer A public key, For the first The first user's One attribute, for Group generator.

[0034] To address the aforementioned problems in the prior art, the present invention also provides a general aggregation signature system based on partial aggregation, comprising: System initialization module: used to execute the initialization algorithm to generate common parameters, and for users and issuers to generate key pairs; The certificate issuance module is used by the issuer to generate certificates for users based on their certificate requests. The credential aggregation module is used to aggregate different credentials issued by the same issuer or different credentials issued by the same user, and generate aggregated credentials. The certificate generation and presentation module is used to randomize the aggregate signature and selectively disclose the certificate according to actual needs by combining zero-knowledge proofs, generate the certificate, and send the certificate to the verifier. Verify the presented credentials module: This module is used by the verifier to verify the validity of the aggregate signature and zero-knowledge proof in the presented credentials. The system initialization module is connected to the certificate issuance module, the certificate issuance module is connected to the certificate aggregation module, the certificate aggregation module is connected to the certificate generation and presentation module, and the certificate generation and presentation module is connected to the certificate verification and presentation module.

[0035] Optionally, the general aggregated signature system is applicable to two aggregation scenarios. The first aggregation scenario refers to the ability to aggregate multiple different signatures signed by the same issuer. The second aggregation scenario refers to the ability to aggregate multiple signatures signed by multiple different issuers, and to achieve selective disclosure and non-linkability of the aggregated credentials.

[0036] Optionally, the first aggregation scenario includes aggregating credentials for different users or credentials for the same user.

[0037] Optionally, the second aggregation scenario includes aggregating different credentials for the same user or different credentials for different users.

[0038] This invention presents a general aggregation signature scheme based on a partial aggregation approach. It not only has fewer aggregation restrictions but also supports the simultaneous aggregation of credentials from different issuers and credentials from the same issuer. Furthermore, it supports the randomization and selective disclosure of aggregated credentials, thereby improving the efficiency of anonymous credential systems while protecting user privacy. This achieves the technical effect of further improving verification efficiency and reducing communication costs while protecting sensitive information. In addition, this invention can achieve credential aggregation while protecting user privacy, with lower storage overhead and communication consumption, resulting in higher system performance. This invention is applicable to fields that handle massive authentication, sensitive data exchange, and require the construction of a trusted collaborative ecosystem, and this cryptographic scheme can be integrated as a core engine into specific application software or service platforms.

[0039] The above-described technical solutions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A general aggregation signature method based on partial aggregation, characterized in that, Includes the following steps: Step 1: The system executes the initialization algorithm to generate common parameters, and the user and issuer generate key pairs; Step 2: The issuer generates credentials for the user based on the user's credential request; Step 3: Based on the application scenario and verification requirements, aggregate different credentials issued by the same issuer or different credentials issued by the same user to generate aggregated credentials; Step 4: Randomize the aggregate signature and selectively disclose the credentials based on actual needs and zero-knowledge proofs, generate the presentation credentials, and send the credentials to the verifier; Step 5: The verifier verifies the validity of the aggregate signature and zero-knowledge proof in the presented credentials.

2. The general aggregation signature method based on partial aggregation according to claim 1, characterized in that, Step 1 includes the following steps: Step 1.1: Input security parameters k Generate common parameters ,in: Here, a third type of bilinear mapping is used, and For three plain books Cyclic groups of order 1 It is a non-degenerate, computationally efficient bilinear mapping; The In the parameters: It is a large prime number; Three prime numbers Cyclic groups of order 1; It is a bilinear mapping function. for Generators of a group for Generators of a group; Step 1.2: First, define: In the formula: and They are respectively The unit element of a group; for The remaining elements in the group excluding the identity element; for The remaining elements in the group excluding the identity element; Next, a key pair is generated for the issuer, and a random selection is made. ,calculate Set the issuer's private key to The public key is ; The random selection For from set Randomly select elements From Randomly select elements The for A group of integers of order 1.

3. The general aggregation signature method based on partial aggregation according to claim 1, characterized in that, Step 2 includes the following steps: Step 2.1: The user sends a credential request to the issuer, where the user's attributes are specified. Defined into three types: attribute values ​​known to the issuer or attribute values ​​jointly determined. A k A promise to obtain an attribute value that the issuer does not know but which is unknown to the issuer. A h Attribute values ​​that are completely hidden from the issuer A c And define the corresponding indexes as follows: ; Step 2.2: The user calculates the commitment value of the commitment attribute, the expression value of the commitment attribute and the hidden attribute, and generates the relevant zero-knowledge proof. ,in: All are random numbers: ； In the formula: NIZK This is a non-interactive zero-knowledge proof; For user attributes; for Random numbers in a group; A h A collection of hidden attributes; Ac For the set of commitment attributes; U For expression; g for Group generator; Y i For the issuer's public key; C i For each commitment attribute; h i for Random numbers in the data; I c For the set of promised attribute indexes; I h A collection of hidden attribute indexes; Step 2.3: The user will use zero-knowledge proofs Send to the issuer; Step 2.4: The issuer first verifies the zero-knowledge proof. Perform verification; if verification passes, generate a signature for all user attributes. and send the signature to the user; In the formula: u for Random numbers in a group; A signature generated by the issuer; g for Group generator; X The issuer's private key; U Expressions sent to users; I k A collection of indexes for public attributes; Y i The issuing public key; m i For user attributes; Step 2.5: The user deblinds the signature. The verification algorithm is used to confirm the credentials; if the equation holds true, the credentials are stored. ; In the formula: e It is a bilinear mapping function; For signature The first element; For computation of zero-knowledge proofs Generated at time Random numbers in a group; The issuing public key; The issuing public key; For user attributes; For signature The second element; for Group generator.

4. The general aggregation signature method based on partial aggregation according to claim 1, characterized in that, Step 3 includes the following steps: Step 3.1: Based on the actual scenario requirements, [the following steps are taken / implemented]... A valid signature aggregation, It's a message. In public key The signatures below are only partially aggregated signatures; Step 3.2: For For Do not aggregate, only aggregate ,in: In the formula: This is a multiplication operation.

5. The general aggregation signature method based on partial aggregation according to claim 1, characterized in that, Step 4 includes the following steps: Step 4.1: When a user presents their credentials, the access policy selectively discloses attributes to the verifier, setting the set of attributes to be displayed to the verifier as follows: The hidden attribute set is set to And define the corresponding indexes as follows: and ; Step 4.2: First, randomize the aggregate signature by randomly selecting... The randomized signature is Then generate a knowledge proof with the signature. Selective disclosure of attributes : ； ； In the formula: for Random numbers in a group; Number of signatures; A collection of indices for hidden attributes; The randomized signature element; For the first The issuer's public key; A set of indexes for disclosed attributes; For the first The first issuer A public key; For the first The first user's One attribute; for Random numbers in the data; For the first A commitment to a set of user attributes; For the first The user-generated number indivual Random numbers for a group; Step 4.3: The user constructs a presentation credential based on the credentials and the proof, and sends the presentation credential to the verifier.

6. The general aggregation signature method based on partial aggregation according to claim 1, characterized in that, Step 5 includes the following steps: Step 5.1: After receiving the presented voucher, the verifying party verifies the proof: First, enter the message. The first element of all signatures The aggregate signature of the second element. and public key Then, the aggregate signature is verified; Step 5.2: If the verification passes, provide the corresponding service to the user, that is: if If it is established, then Valid; otherwise, the signature is invalid. In the formula: This is a multiplication operation; Number of signatures; e It is a bilinear mapping function; For the first The issuer's public key; For the first The first issuer A public key, For the first The first user's One attribute, for Group generator.

7. A general aggregation signature system based on partial aggregation, characterized in that, include: System initialization module: used to execute the initialization algorithm to generate common parameters, and for users and issuers to generate key pairs; The certificate issuance module is used by the issuer to generate certificates for users based on their certificate requests. The credential aggregation module is used to aggregate different credentials issued by the same issuer or different credentials issued by the same user, and generate aggregated credentials. The certificate generation and presentation module is used to randomize the aggregate signature and selectively disclose the certificate according to actual needs by combining zero-knowledge proofs, generate the certificate, and send the certificate to the verifier. Verify the presented credentials module: This module is used by the verifier to verify the validity of the aggregate signature and zero-knowledge proof in the presented credentials. The system initialization module is connected to the certificate issuance module, the certificate issuance module is connected to the certificate aggregation module, the certificate aggregation module is connected to the certificate generation and presentation module, and the certificate generation and presentation module is connected to the certificate verification and presentation module.

8. The general aggregate signature system based on partial aggregation according to claim 7, characterized in that, The general aggregated signature system is applicable to two aggregation scenarios. The first aggregation scenario refers to the ability to aggregate multiple different signatures signed by the same issuer. The second aggregation scenario refers to the ability to aggregate multiple signatures signed by multiple different issuers, and to achieve selective disclosure and non-linkability of the aggregated credentials.

9. The general aggregate signature system based on partial aggregation according to claim 8, characterized in that, The first type of aggregation scenario includes aggregating credentials for different users or credentials for the same user.

10. The general aggregate signature system based on partial aggregation according to claim 8, characterized in that, The second type of aggregation scenario includes aggregating different credentials for the same user or different credentials for different users.

Images