A multi-party collaborative signature method, verification method and device

Abstract

The application provides a multi-party collaborative signature method, a verification method and a device, wherein the multi-party collaborative signature method comprises the following steps: obtaining post-quantum signature key pairs of a plurality of participants; wherein the participants hold corresponding private keys and public keys; binding all the public keys to the same subject to generate a combined certificate; wherein the combined certificate has a signature policy authorized by all the participants; performing an online signature protocol through the participants meeting a threshold number to generate a combined signature value according to the signature policy; and generating a signature result according to the combined certificate and the combined signature value. Through the collaborative design of the combined certificate identity binding and the combined message representing the unified coding and online commitment interaction protocol, multi-party common authorization can be realized without modifying the standard post-quantum signature algorithm kernel, and each single-party signature can be directly verified by an unmodified standard post-quantum verifier.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a multi-party collaborative signature method, verification method, and apparatus. Background Technology

[0002] With the development of quantum computing, traditional public-key cryptosystems (such as RSA and ECDSA) face the risk of being cracked, making post-quantum cryptography (PQC) a research hotspot. Currently, lattice-based digital signature algorithms ML-DSA (FIPS204) and FN-DSA (Falcon) have been standardized. However, the internal mechanisms of these post-quantum signature algorithms, such as rejection sampling, trapdoor Gaussian sampling, and norm bounds, make it extremely difficult to directly convert them into threshold signatures.

[0003] Existing two-party threshold signature schemes have achieved success on classic Schnorr signatures, but cannot be directly migrated to post-quantum signatures. Existing post-quantum threshold signature schemes, such as those by delPino and Niot, and TalonG, while implementing threshold functionality, typically require custom verifiers and cannot use standard ML-DSA or FN-DSA verifiers, increasing deployment complexity. Furthermore, these schemes often require complex mechanisms such as distributed key generation and secret sharing, making them unsuitable for rapid engineering deployment. Summary of the Invention

[0004] In view of the aforementioned problems, this application is proposed to provide a multi-party collaborative signature method, verification method, and apparatus that overcomes or at least partially solves the aforementioned problems, comprising: A multi-party collaborative signature method, wherein the method involves several parties, and a threshold number of parties collaboratively execute a signature protocol, comprising the following steps: Obtain post-quantum signature key pairs from several participating parties; wherein each participating party holds a corresponding private key and public key; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; Based on the signature strategy, the participating parties, meeting a threshold number, collaboratively execute the online signature protocol to generate a combined signature value; A signature result is generated based on the combined certificate and the combined signature value.

[0005] Furthermore, the step of obtaining post-quantum signature key pairs from several participating parties, wherein each participating party holds a corresponding private key and public key, includes: The participating parties independently generate quantum signature key pairs locally, obtaining a one-to-one corresponding private key and public key; The participating parties shall perform local secure storage of the generated private key; The signature key pair is limited to signature scenarios specifically used for the corresponding combined certificate.

[0006] Further, the step of binding all the public keys to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties, includes: Arrange all the public keys of the participating parties according to a preset rule to obtain an ordered set of public keys; By binding all public keys to the same certificate subject through the ordered public key set and configuring a signature policy jointly authorized by multiple parties, a composite certificate is generated. A hash operation is performed on the standard encoding result of the combined certificate to obtain the combined certificate hash as the unique identifier of the certificate.

[0007] Furthermore, the step of generating a combined signature value by having the participating parties collaboratively execute the online signature protocol according to the signature strategy and meeting a threshold number of participants includes: The participants generate local random numbers and corresponding commitment values, and exchange the commitment values ​​of each participant through multiple rounds of interaction to obtain a global commitment set. All participants are verified based on the global commitment set. Specifically, each participant discloses a local random number corresponding to its commitment value, and the consistency between the participant's commitment value and the corresponding random number is verified. If the verification fails, the corresponding participant is excluded from the protocol. If the number of participants that pass the verification does not meet the threshold requirement of the signature policy, the protocol is terminated. After the verification is passed, the participants that meet the threshold number obtain a unified public session binding value through the global commitment set and the local random number; The signature base message is obtained by combining the public session binding value with the message digest of the message to be signed. Based on the signature base message, a unified combined message representative is generated. Each participating party that meets the threshold number of participants signs the combined message representative using its corresponding private key to obtain the corresponding unilateral signature. Generate a combined signature value based on all the unilateral signatures.

[0008] Furthermore, it also includes session authentication, including the following steps: The participating parties sequentially generate session authentication messages based on the global commitment set and the session context, and obtain a representative session authentication message through a combination layer encoding. The participating party obtains a session authentication signature by signing the session authentication message representative with its own private key, and completes cross-validation through the session authentication signature; When the session authentication signatures of all participating parties to be signed are verified, the identity of the participating parties and the content of the commitment interaction are confirmed to be true and valid.

[0009] Furthermore, the step of generating a unified combined message representative based on the signature base message includes: The signature base message is concatenated with the algorithm suite identifier, fixed prefix, scene label, and context information in a pre-defined order to obtain the complete encoded message; Perform a pre-hashing operation on the complete encoded message to output a combined message representative in a uniform format.

[0010] Further, the step of generating a signature result based on the combined certificate and the combined signature value includes: Extract the combined certificate hash as the certificate identifier, and extract the public session binding value as the session identifier; The certificate identifier, the session identifier, and the combined signature value are assembled according to a preset data structure to obtain a basic signature dataset; When the signature strategy is a multi-party threshold strategy, the participating parties supplement the basic signature dataset with participant identification information; wherein, the participant identification information includes the sequence number of each participating party's public key in the combined certificate, and the corresponding positions of participating parties who did not participate in the signature are encoded with placeholders; the multi-party threshold strategy is a threshold of more than 2 parties; The basic signature dataset is subjected to standardized encoding to generate signature results.

[0011] A multi-party collaborative signature method, which is executed through a sequential countersigning mode, involves multiple parties, and the method includes the following steps: (The steps are not provided in the original text.) Obtain post-quantum signature key pairs from several participating parties; wherein each participating party holds a corresponding private key and public key; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; According to the signature strategy, the participating parties, meeting a threshold number, collaboratively execute a co-signing protocol to generate a combined signature value. Specifically, the participating parties determine the signing order according to a preset arrangement of public keys in the combined certificate. Each participating party constructs a basic signature message based on the combined certificate hash, its own timestamp, the message digest of the previous signature, and the message to be signed, according to the signing order. A combined message representative is generated through combined layer encoding, and the participating party signs the combined message representative using its own private key to obtain a single-party signature. This single-party signature is then sent to the next adjacent participating party until all participating parties have completed the signing process. When all participating parties have completed their signing, all valid single-party signatures are aggregated according to the preset arrangement to generate the combined signature value. A signature result is generated based on the combined certificate and the combined signature value. A multi-party collaborative signature verification method, the method being used to verify the signature result generated by any of the methods described above, includes the following steps: Obtain the multi-signature result to be verified, the corresponding combined certificate and the message digest of the message to be verified, and verify the validity of the combined certificate; Based on the combined certificate, the public keys and algorithm suite information of all participants are obtained, and the combined signature value, public session binding value and combined certificate hash are obtained through the signature result. The combined signature value is split in a preset order to obtain the individual signatures corresponding to each position. The valid unilateral signature and its corresponding valid public key in the composite certificate are determined by the participant sequence identifier or placeholder information in the signature result. Based on the combined certificate hash, public session binding value, and message digest, the signature base message is reconstructed, and the corresponding combined message representative is generated; The combined message representative and the corresponding valid unilateral signature are verified using the valid public key. When the number of valid unilateral signatures that pass the verification meets the threshold requirement agreed upon in the combined certificate, the signature result is determined to be valid.

[0012] A multi-party collaborative signature method, wherein the method achieves certificate-free collaborative authorization through a message recovery signature mode, involving multiple parties, and wherein a threshold number of parties collaboratively execute the signature protocol, includes the following steps: Obtain the system master public key and system master private key from the key generation center, as well as the post-quantum signature key pairs of each participant; among them, each participant's user public key is split into a recoverable part and an explicit part; The key generation center uses the message recovery signature mode to generate the combined identity binding signature; the recoverable part of the combined identity binding signature carries the recoverable part of the public key of the first participant in the order, and the explicit part includes user identity information, the explicit part of the first party's public key, the complete public keys of other participants, and the collaborative signature strategy. Each participant performs the signing sequentially according to a preset order; the user signature generated by the participant at the beginning of the sequence has a recoverable portion containing the recoverable portion of the public key of the next participant, and an explicit portion containing the signing context; the user signature generated by the participant at the end of the sequence has a recoverable portion containing the recoverable portion of the message to be signed, and an explicit portion containing the explicit portion of the message to be signed. The combined identity binding signature, the explicit portions of the public keys of all participants, the complete public keys of non-participants, the signatures of all participants, and the explicit portions of the message to be signed are assembled to generate a signature result.

[0013] Furthermore, the collaborative signature strategy supports 2-of-2 and t-of-n threshold authorization configurations; The explicit portion of the combined identity binding signature also includes a domain separation tag and a timestamp; The participating parties include one or more of the following: mobile terminals, cloud servers, and hardware security modules.

[0014] A multi-party collaborative signature verification method, the method being used to verify the signature result generated by any of the methods described above, includes the following steps: Obtain the collaborative signature transmission object to be verified and the system master public key of the key generation center; The combined identity binding signature is used to perform message recovery. The recoverable part of the public key of the first participant is extracted and concatenated to obtain the complete public key. The signatures of the corresponding users are performed sequentially using the complete public keys of the preceding participants in a preset order. The recoverable part of the public key of the next participant is extracted and concatenated to obtain the corresponding complete public key, until the complete public keys of all participants are obtained. After verifying the signature of the last user, the recoverable part of the message to be signed is extracted and concatenated to obtain the complete message to be signed. Perform full verification of the corresponding user signature using the complete public key of each participant, and perform full verification of the combined identity binding signature using the system master public key; When the number of valid user signatures that pass verification meets the threshold requirement of the agreed collaborative signature policy, the collaborative signature transmission object is determined to be legal and valid.

[0015] A multi-party collaborative signature apparatus, the apparatus implementing the steps of any of the above-described multi-party collaborative signature methods: include: An acquisition module is used to acquire post-quantum signature key pairs from several participating parties; wherein, each participating party holds a corresponding private key and public key; A composite certificate module is used to bind all the public keys to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; The combined signature value module is used to generate a combined signature value by having the participating parties, who meet a threshold number, collaboratively execute the online signature protocol according to the signature strategy. The multi-party signature result module is used to generate a multi-party signature result based on the combined certificate and the combined signature value.

[0016] A computer electronic device, characterized in that it includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described in any one of the above.

[0017] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the preceding claims.

[0018] This application has the following advantages: In the embodiments of this application, compared with the problems of post-quantum threshold signatures in the prior art, such as needing to modify the standard algorithm kernel, relying on complex distributed key generation, poor compatibility with existing PKI systems, and high deployment costs, this application provides a multi-party collaborative signature method. The method involves several participants, and the number of participants meeting a threshold collaboratively executes the signature protocol. The method includes the following steps: obtaining post-quantum signature key pairs from several participants; wherein each participant holds a corresponding private key and public key; binding all the public keys to the same entity to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participants; generating a combined signature value by collaboratively executing an online signature protocol by the number of participants meeting the threshold according to the signature policy; and generating a signature result based on the combined certificate and the combined signature value. By combining certificate identity binding, unified encoding of combined messages, and an online commitment interaction protocol, this solution resolves the core contradictions of traditional post-quantum collaborative signatures, which require splitting private keys and are incompatible with standard verifiers. It enables multi-party authorization without modifying the standard post-quantum signature algorithm kernel, and each individual signature can be directly verified by the unmodified standard post-quantum verifier, significantly reducing deployment and adaptation costs for dependent parties. The solution does not split private keys throughout the process, does not rely on threshold trapdoors or distributed key generation mechanisms, and each participant's private key is independently stored locally. This avoids security risks associated with key distribution and significantly simplifies key management, lowering the barrier to project implementation. The combined certificate binds multiple public keys to the same entity and incorporates a built-in signature policy, naturally adapting to existing PKI certificate systems. It enables certificate-level identity binding and policy enforcement, conforming to the usage habits and regulatory requirements of traditional public key infrastructures. The online signature protocol uses a commitment and open mechanism to generate public session binding values, ensuring session freshness and replay protection, and avoiding security risks caused by unilateral manipulation of session randomness. The solution supports a variety of standardized post-quantum signature algorithms, such as modular lattices and fast Fourier lattice bases. It can be flexibly adapted to any multi-party collaborative scenario with two or more parties, and is compatible with various deployment environments such as general servers, embedded terminals, and hardware acceleration. It can be directly integrated into the existing post-quantum cryptography application system, with low transformation and adaptation costs and clear security boundaries. It takes into account the security of multi-party collaborative authorization, standard algorithm compatibility, PKI system adaptability, and practicality for engineering implementation. Attached Figure Description

[0019] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the steps of a multi-party collaborative signature method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating the steps of a multi-party collaborative signature method implemented in a co-signing mode according to an embodiment of this application. Figure 3 This is a flowchart illustrating the steps of a multi-party collaborative signature verification method provided in one embodiment of this application; Figure 4 This is a flowchart illustrating the steps of a certificateless multi-party collaborative signature method according to an embodiment of this application. Figure 5 This is a flowchart illustrating the steps of a certificate-free verification method for a multi-party collaborative signature method provided in an embodiment of this application. Figure 6 This is a structural block diagram of a multi-party collaborative signature method apparatus provided in an embodiment of this application; Figure 7 This is a structural block diagram of a multi-party collaborative signature verification device provided in one embodiment of this application; Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention; 1. Computer equipment; 2. External devices; 3. Processing unit; 4. Bus; 5. Network adapter; 6. I / O interface; 7. Display; 8. Memory; 9. Random access memory; 10. Cache memory; 11. Storage system; 12. Program / utility; 13. Program module. Detailed Implementation

[0021] To make the objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] The inventors discovered through analysis of existing technologies that current two-party threshold signature schemes cannot be directly migrated to post-quantum signatures. Existing post-quantum threshold signature schemes, such as the delPino and Niot schemes and TalonG, while implementing the threshold function, typically require custom verifiers and cannot use standard ML-DSA or FN-DSA verifiers, increasing deployment complexity.

[0023] Reference Figure 1 This application illustrates a multi-party collaborative signature method, in which several parties participate, and a threshold number of parties collaboratively execute a signature protocol, including the following steps: S110. Obtain post-quantum signature key pairs from several participating parties; wherein, each participating party holds a corresponding private key and public key; S120. Bind all the public keys to the same subject to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participating parties; S130. Based on the signature strategy, the participating parties that meet the threshold number collaboratively execute the online signature protocol to generate a combined signature value; S140. Generate a signature result based on the combined certificate and the combined signature value.

[0024] In the embodiments of this application, compared with the problems of post-quantum threshold signatures in the prior art, such as needing to modify the standard algorithm kernel, relying on complex distributed key generation, poor compatibility with existing PKI systems, and high deployment costs, this application provides a multi-party collaborative signature method. The method involves several participants, and the number of participants meeting a threshold collaboratively executes the signature protocol. The method includes the following steps: obtaining post-quantum signature key pairs from several participants; wherein each participant holds a corresponding private key and public key; binding all the public keys to the same entity to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participants; generating a combined signature value by collaboratively executing an online signature protocol by the number of participants meeting the threshold according to the signature policy; and generating a signature result based on the combined certificate and the combined signature value. By combining certificate identity binding, unified encoding of combined messages, and an online commitment interaction protocol, this solution resolves the core contradictions of traditional post-quantum collaborative signatures, which require splitting private keys and are incompatible with standard verifiers. It enables multi-party authorization without modifying the standard post-quantum signature algorithm kernel, and each individual signature can be directly verified by the unmodified standard post-quantum verifier, significantly reducing deployment and adaptation costs for dependent parties. The solution does not split private keys throughout the process, does not rely on threshold trapdoors or distributed key generation mechanisms, and each participant's private key is independently stored locally. This avoids security risks associated with key distribution and significantly simplifies key management, lowering the barrier to project implementation. The combined certificate binds multiple public keys to the same entity and incorporates a built-in signature policy, naturally adapting to existing PKI certificate systems. It enables certificate-level identity binding and policy enforcement, conforming to the usage habits and regulatory requirements of traditional public key infrastructures. The online signature protocol uses a commitment and open mechanism to generate public session binding values, ensuring session freshness and replay protection, and avoiding security risks caused by unilateral manipulation of session randomness. The solution supports a variety of standardized post-quantum signature algorithms, such as modular lattices and fast Fourier lattice bases. It can be flexibly adapted to any multi-party collaborative scenario with two or more parties, and is compatible with various deployment environments such as general servers, embedded terminals, and hardware acceleration. It can be directly integrated into the existing post-quantum cryptography application system, with low transformation and adaptation costs and clear security boundaries. It takes into account the security of multi-party collaborative authorization, standard algorithm compatibility, PKI system adaptability, and practicality for engineering implementation.

[0025] It should be noted that this scheme does not modify the core of the standard post-quantum signature algorithm, nor does it employ private key splitting, secret sharing, or distributed key generation mechanisms. Instead, it achieves collaborative authorization between the two parties through upper-layer combined protocols and mechanisms. All unilateral signatures are independently generated from complete standard post-quantum private keys and can be directly verified by native standard verifiers without the need for customized verification logic, thus maximizing the reuse of mature implementations in the existing post-quantum cryptography ecosystem.

[0026] As described in step S110, obtain post-quantum signature key pairs from several participating parties; wherein, the participating parties hold corresponding private keys and public keys.

[0027] It is important to note that the post-quantum signature key pair serves as the identity credential and signing authority carrier for each participant. All participants' key pairs are independent, and private key permissions are autonomously controlled by each participant. This eliminates the need for distributed key generation and secret sharing mechanisms, which is the fundamental prerequisite for this scheme to achieve multi-party decentralized authorization and compatibility with standard post-quantum verifiers. Each participant independently executes the key generation process of the standard post-quantum signature algorithm locally. The private key remains stored in a secure local environment throughout the process, without being split, shared, or transmitted across devices. All signature operations are performed locally, converging the security boundary within the participant itself, thus avoiding the leakage risks and management costs associated with key fragmentation and distribution. By limiting the signature key pair to signature scenarios specifically for corresponding composite certificates, the principle of domain separation in cryptographic protocols is followed, avoiding cross-protocol attack risks caused by reusing the same key pair across multiple certificates and protocols. This ensures a one-to-one correspondence between the key authorization scope and the constraints of the composite certificate.

[0028] In one embodiment of the present invention, the specific process of "obtaining post-quantum signature key pairs of several participating parties; wherein the participating parties hold corresponding private keys and public keys" in step S110 can be further described in conjunction with the following description.

[0029] As described in the following steps, the participating party independently generates a quantum signature key pair locally, obtaining a one-to-one corresponding private key and public key; It should be noted that each participating party independently executes the key generation process of the standard quantum signature algorithm without interacting with the other party or relying on complex distributed key generation protocols. The key generation interfaces of existing standardized algorithms such as ML-DSA and FN-DSA can be directly reused without custom development.

[0030] As described in the following steps, the participating party performs local secure storage of the generated private key; It should be noted that the private key is stored in the local secure environment of the participating party throughout the process, without being split or transmitted across devices. All signature operations are completed locally, and the security boundary converges within the participating party itself, avoiding the leakage risk and management cost caused by key fragmentation and distribution.

[0031] As described in the following steps, the signing key pair is limited to a signing scenario specifically for the corresponding combined certificate; It should be noted that the key pair is restricted to use exclusively for the corresponding composite certificate, which follows the domain separation principle of cryptographic protocols. This avoids the risk of cross-protocol attacks caused by the reuse of the same key pair in multiple scenarios, and ensures that the scope of key authorization corresponds one-to-one with the scope of constraints of the composite certificate.

[0032] As described in step S120, all the public keys are bound to the same subject to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participating parties.

[0033] It should be noted that composite certificates are issued by authoritative certificate authorities and serve as a trusted carrier for multi-party identity binding and authorization strategies. They unify multiple independent public keys under the same entity, making collaborative signatures naturally compatible with the management specifications and regulatory requirements of the existing PKI system.

[0034] In one embodiment of the present invention, the specific process of step S120, "binding all the public keys to the same subject to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participating parties," can be further described in conjunction with the following description.

[0035] As described in the following steps, the public keys of all the participating parties are arranged according to a preset rule to obtain an ordered set of public keys; It should be noted that the public keys are arranged in a preset order as a unified benchmark for subsequent combined signature serialization and verification parsing. The serialization order of the combined signature values ​​corresponds one-to-one with the order of the public keys, which can avoid signature parsing errors and verification failures caused by order ambiguity.

[0036] As described in the following steps, all public keys are bound to the same certificate subject through the ordered public key set, and a signature policy jointly authorized by multiple parties is configured to generate a composite certificate; It should be noted that binding multiple public keys to the same certificate subject can be adapted to actual business scenarios such as dual-role authorization and dual-person approval within an organization; the two-party joint authorization policy built into the certificate is enforced by the certificate itself, and signatures that do not meet the requirements of joint authorization by both parties cannot pass the certificate policy verification.

[0037] As described in the following steps, a hash operation is performed on the standard encoding result of the combined certificate to obtain the combined certificate hash as the unique identifier of the certificate; It should be noted that the combined certificate hash is obtained by hashing the DER standard encoding of the combined certificate. As the unique cryptographic identifier of the certificate, its size is much smaller than that of the complete certificate. It can be directly embedded in the signature object, which not only achieves a strong binding between the signature and the certificate, but also avoids the expansion of the signature size caused by carrying the complete certificate.

[0038] As described in step S130, the online signature protocol is executed collaboratively by the participating parties that meet the threshold number, in accordance with the signature strategy, to generate a combined signature value.

[0039] It should be noted that the online signature protocol is the core interactive process for achieving multi-party collaborative authorization. Under the premise of not splitting the private key or rewriting the core of the standard quantum signature algorithm, it ensures that the participating parties who meet the signature policy requirements can jointly complete the generation of a legal and valid signature through commitment, open interaction, unified message encoding and threshold fault tolerance mechanism.

[0040] Each participant exchanges commitment values ​​before disclosing their local random numbers, which prevents any single participant from manipulating the session results after obtaining others' random numbers. This ensures the fairness of the generation of public session binding values ​​and the freshness of the session, effectively resisting replay attacks and session hijacking. The verification process supports the removal of abnormal participants with inconsistent commitments. As long as the number of remaining honest participants meets the threshold requirement, execution can continue, balancing the robustness of the protocol with the strictness of the authorization rules.

[0041] All valid participants construct a consistent signature base message based on the same combined certificate hash, public session binding value, and message digest. Then, a standard format combined message representative is generated through unified combination layer rules to ensure that the inputs for each party's signature are completely consistent. Each participant independently completes the signature operation using its own complete standard post-quantum private key, without the need for private key sharding or collaborative operation. The signature process is completely consistent with the standard single-signature process, which not only ensures that the private key security boundary converges locally, but also allows each single-party signature to be directly verified by the native standard post-quantum verifier without the need for customized verification logic.

[0042] In one embodiment of the present invention, the specific process of step S130, "according to the signature strategy, the participating parties that meet the threshold number collaboratively execute the online signature protocol to generate a combined signature value," can be further explained in conjunction with the following description.

[0043] As described in the following steps, the participants generate local random numbers and corresponding commitment values, and exchange the commitment values ​​of each participant through multiple rounds of interaction to obtain a global commitment set; It should be noted that each participant submits a digest of its local random number in the form of a cryptographic hash commitment, without disclosing the random number itself. This ensures that any participant has locked its own random number before learning the random values ​​of others, preventing malicious participants from adjusting their own values ​​based on others' random numbers and manipulating subsequent session outputs. This guarantees that the random contributions of all participants are equal and tamper-proof. The global commitment set is a unified and ordered summary of the commitment values ​​submitted by all participants. It serves as the unified benchmark for subsequent commitment validity verification, session identity authentication, and calculation of public session binding values, ensuring that all participants execute all subsequent protocol steps based on a completely consistent commitment set. This guarantees the consistency and traceability of protocol execution from the data source. In multi-party threshold scenarios, even if a participant is subsequently removed due to verification failure, the global commitment set still retains complete commitment records of all initial participants. This can be used for abnormal behavior tracing and protocol auditing, balancing the robustness and accountability of the protocol.

[0044] As described in the following steps, all participants are verified based on the global commitment set; specifically, each participant discloses a local random number corresponding to its commitment value, and the consistency between the participant's commitment value and the corresponding random number is verified; if the verification fails, the corresponding participant is excluded from the protocol; if the number of participants that pass does not meet the threshold requirement of the signature policy, the protocol is terminated. It should be noted that by publicly displaying local random numbers and comparing them with pre-submitted commitment values, the authenticity of each participant's commitment is verified, preventing participants from submitting false commitments or subsequently tampering with the random numbers, thus ensuring the credibility of protocol interactions. An abnormal participant removal and threshold judgment mechanism is set up to ensure that the protocol can still continue to execute as long as the authorization threshold is met, even if some participants abnormally exit or submit invalid commitments, balancing protocol robustness with the authorization constraints of the signature policy; when the number of valid participants is insufficient to meet the threshold requirement, the protocol is terminated, strictly adhering to the signature authorization rules agreed upon in the combined certificate.

[0045] As described in the following steps, the participants who meet the threshold number obtain a unified public session binding value through the global commitment set and the local random number; It should be noted that the public session binding value is derived from the commitments of all valid participants and a publicly available local random number. No single participant can unilaterally determine the final result of this value, ensuring its global uniqueness and unmanipulation. As the unique cryptographic identifier for this signing session, the public session binding value strongly binds the signature to the current session, effectively resisting replay attacks and session hijacking, and ensuring the freshness and non-reusability of each signature.

[0046] As described in the following steps, the signature base message is obtained by combining the public session binding value with the message digest of the message to be signed; It's important to note that the signature base message serves as a unified binding carrier for identity authorization, session context, and business messages. It's constructed by combining three core elements: the combined certificate hash, the common session binding value, and the message digest to be signed. This ensures that the signature is only valid for the current combined certificate, the current session, and the current message to be signed. Any tampering with any of these three elements will change the signature base message, leading to signature verification failure. This cryptographically guarantees a strong binding relationship between the signature and identity, session, and message, aligning with the core design goal of collaborative signatures.

[0047] As described in the following steps, a unified composite message representative is generated based on the signature base message. The participating parties that meet the threshold number of participants sign the composite message representative using their corresponding private keys to obtain the corresponding unilateral signature. It should be noted that the combined message representative is the direct input to the standard post-quantum signature algorithm. The combination layer performs structured encoding and pre-hashing on the basic signature message, converting the variable-length message content into a fixed-length format that meets the input requirements of the standard algorithm. Each participant generates the same combined message representative based on a completely identical basic signature message. The signing process does not need to be aware of the combined signature context and can directly call the standard post-quantum signature algorithm interface to complete the computation without modifying the algorithm kernel. This is the core design feature of this solution, ensuring compatibility with the native standard verifier.

[0048] As described in the following steps, a combined signature value is generated based on all of the unilateral signatures; It should be noted that the individual signatures of all valid participants are aggregated according to the preset arrangement order of the public keys in the composite certificate to form a structured composite signature value. This ensures the integrity of the signature output, facilitates cross-system transmission and storage, and also ensures that the verification end can split and verify each individual signature in the corresponding order. The aggregation order corresponds one-to-one with the arrangement order of the public keys in the composite certificate, which avoids parsing errors and verification failures caused by ambiguity in the signature order, and ensures the consistency of signature generation and verification.

[0049] In one embodiment of the present invention, session identity authentication is further included, comprising the steps of: As described in the following steps, the participating parties sequentially generate session authentication messages based on the global commitment set and the session context, and obtain session authentication message representatives through composite layer encoding; It should be noted that the session authentication message is generated before the local random number is made public. It only uses the global commitment set and the session context as input, which can complete the pre-verification of identity legitimacy before exposing sensitive random numbers. The session authentication message representative is generated using a unified combination layer encoding rule, which is consistent with the generation architecture of the combination message representative of the main signature. It reuses the domain separation mechanism to avoid the risk of cross-protocol attacks.

[0050] As described in the following steps, the participating party obtains a session authentication signature by signing the session authentication message representative with its own private key, and completes cross-validation through the session authentication signature; It should be noted that each participant uses its own complete standard post-quantum private key to complete the session authentication signature, without modifying the algorithm kernel. The signing process is completely consistent with the standard single-signature process. Through multi-party cross-verification, it can be confirmed that each commitment value is submitted by a legitimate participant holding the corresponding private key, preventing malicious third parties from impersonating participants to inject false commitments and ensuring the authenticity of identities during the commitment exchange process.

[0051] As described in the following steps, when the session authentication signatures of all participating parties to be signed are verified, the identity of the participating parties in the commitment interaction and the commitment content are confirmed to be true and valid.

[0052] It should be noted that successful session authentication is a prerequisite for proceeding to subsequent protocol stages. Only after the identities of all parties involved in signing have been verified will the calculation of the local random number public and public session binding value continue. This prevents unauthorized entities from obtaining session random information and reduces the risk of session hijacking. Successful authentication also signifies that all participants have reached a consensus on the current global commitment set.

[0053] In one embodiment of the present invention, the specific process of the step "generating a unified combined message representative based on the signature base message" can be further explained in conjunction with the following description.

[0054] As described in the following steps, the signature base message is concatenated with the algorithm suite identifier, fixed prefix, scene label, and context information in a pre-defined order to obtain a complete encoded message; It should be noted that by concatenating the basic signature message with the algorithm suite identifier, fixed prefix, scenario label, and context information in a pre-defined order, domain separation can be achieved between different protocol scenarios and different algorithm suites, preventing the signature from being reused in different scenarios and preventing cross-protocol attacks.

[0055] As described in the following steps, a pre-hashing operation is performed on the complete encoded message to output a combined message representative in a uniform format; It should be noted that by using a pre-hashing function to convert variable-length encoded messages into fixed-length combined message representations, the input format requirements of the standard post-quantum signature algorithm are met, and the amount of input data for signature operations is compressed, thereby improving the efficiency of signature execution.

[0056] As described in step S140, a signature result is generated based on the combined certificate and the combined signature value.

[0057] It should be noted that the signature result is the final output of the entire collaborative signature process, centrally carrying three core verification elements: certificate identity, session binding information, and unilateral signature data. The unified encapsulation structure is compatible with both online commitment mode and sequential countersigning mode outputs. The verification end does not need to pre-distinguish the signature generation method to perform standardized parsing and verification, reducing integration and deployment costs.

[0058] In one embodiment of the present invention, the specific process of "generating a signature result based on the combined certificate and the combined signature value" in step S140 can be further explained in conjunction with the following description.

[0059] As described in the following steps, extract the combined certificate hash as the certificate identifier and extract the public session binding value as the session identifier; It should be noted that the combined certificate hash is extracted as the certificate identifier, and the public session binding value is extracted as the session identifier. By using the combined certificate hash as the certificate identifier and the public session binding value as the session identifier, the binding relationship verification can be completed by carrying only the digest class identifier. There is no need to embed the complete certificate in the signature object, thus controlling the size of the signature object while ensuring the integrity of the verification.

[0060] As described in the following steps, the certificate identifier, the session identifier, and the combined signature value are assembled according to a preset data structure to obtain a basic signature dataset; It should be noted that the basic signature dataset is the minimum complete verification set for a two-party scenario, containing all the core fields required to complete signature validity verification. Assembling it according to a pre-defined fixed structure ensures that signature results generated by different implementation entities have unified parsing rules, avoiding verification anomalies caused by differences in field order or encoding format, and guaranteeing the interoperability and deployment compatibility of the solution.

[0061] As described in the following steps, when the signature strategy is a multi-party threshold strategy, the participating party supplements the participating party identification information in the basic signature dataset; It should be noted that in multi-party threshold scenarios, the actual number and position of participating parties in the signing process are not fixed, and relying solely on the default arrangement order cannot accurately match valid signatures with their corresponding public keys. By marking the sequence number of the participating parties' public keys or setting placeholders in unparticipated positions, the verification end can quickly locate valid unilateral signatures and their corresponding public keys, accurately verify whether the number of valid signatures meets the threshold requirements of the signature policy, and adapt to various flexible authorization configurations.

[0062] Reference Figure 2 As described in the following steps, the basic signature dataset is subjected to standardized encoding to generate signature results; It should be noted that by uniformly encapsulating the signature dataset through a standardized encoding format, cross-platform, cross-language, and cross-system interactive compatibility can be achieved, adapting to the transmission and storage requirements of different business scenarios.

[0063] In one embodiment of the present invention, a multi-party collaborative signature method is also proposed. This method is executed through a sequential countersigning mode, involving several participating parties. A threshold number of participating parties collaboratively execute the countersigning protocol, including the following steps: S210. Obtain post-quantum signature key pairs from several participating parties; wherein, each participating party holds a corresponding private key and public key; S220. Bind all the public keys to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; S230. Based on the signature strategy, the participating parties that meet the threshold number collaboratively execute the co-signature protocol to generate a combined signature value. In one embodiment of the present invention, the specific process of step S230, "according to the signature policy, the participating parties that meet the threshold number collaboratively execute the co-signature protocol to generate a combined signature value," can be further explained in conjunction with the following description.

[0064] As described in the following steps, the participating parties determine the signing order according to the preset arrangement order of the public keys in the combined certificate; It should be noted that using the preset arrangement of public keys in the combined certificate as the execution order of the countersigning process maintains consistency with the serialization benchmark for unilateral signatures in the online protocol mode. This avoids parsing errors and verification failures caused by ambiguity in the signature order, and provides a unified execution basis for subsequent hierarchical transmission and sequential aggregation. The countersigning mode does not require multiple parties to interact online simultaneously; it achieves asynchronous sequential signing through a fixed order, adapting to non-real-time business scenarios such as hierarchical approval and sequential countersigning.

[0065] As described in the following steps, the participating party constructs a basic signature message based on the combined certificate hash, its own timestamp, the message digest of the previous signature and the message to be signed in the order of the signatures, generates a combined message representative through the combined layer encoding, signs the combined message representative with its own private key to obtain a unilateral signature, and sends the unilateral signature to the next adjacent participating party until all participating parties are traversed. It should be noted that the countersignature adopts a chain-like progressive generation logic: the first participant constructs the first signature base message based on the combined certificate hash, its own timestamp, and the message digest to be signed; subsequent participants need to add all the preceding unilateral signatures on the basis of the above elements to construct their own corresponding signature base message, thereby realizing a strong binding between the preceding signature and the subsequent signature, preventing the preceding signature from still passing the verification after being tampered with.

[0066] All participants use a unified combination layer encoding rule to generate combined message representatives, directly calling the standard post-quantum signature algorithm to complete the signature operation without modifying the algorithm kernel. Each unilateral signature can be independently verified by the native standard verifier. The signature results are transmitted sequentially in a preset order, eliminating the need for full multi-party interaction. The protocol is lightweight and adaptable to asynchronous deployment scenarios.

[0067] As described in the following steps, when all the participating parties have completed their signatures, all valid unilateral signatures are aggregated according to the preset arrangement order to generate a combined signature value.

[0068] It should be noted that all valid unilateral signatures are aggregated according to the preset order of the public keys of the composite certificate to form a structured composite signature value. This is consistent with the final output format of the online protocol mode, allowing signature objects of both signature modes to use unified parsing and verification logic, reducing the adaptation cost at the verification end. The aggregation process only concatenates valid unilateral signatures in an orderly manner without modifying the individual unilateral signatures themselves, thus preserving the standard verifiability of each unilateral signature.

[0069] S240. Generate a signature result based on the combined certificate and the combined signature value.

[0070] Reference Figure 3 In one embodiment of the present invention, a multi-party collaborative signature verification method is also proposed. This method is used to verify the signature result generated by any of the methods described above, and includes the following steps: S310. Obtain the signature result to be verified, the corresponding combined certificate and the message digest of the message to be verified, and verify the validity of the combined certificate; S320. Obtain the public keys and algorithm suite information of all participants based on the combined certificate, and obtain the combined signature value, public session binding value and combined certificate hash through the signature result. Split the combined signature value in a preset order to obtain the unilateral signature corresponding to each position. S330. Determine the valid unilateral signature and its valid corresponding public key in the composite certificate by using the participant sequence identifier or placeholder information in the signature result; S340. Reconstruct the signature base message based on the combined certificate hash, public session binding value, and message digest, and generate the corresponding combined message representative; S350. Perform standard quantum signature verification on the combined message representative and the corresponding valid unilateral signature using the valid corresponding public key. When the number of valid unilateral signatures that pass verification meets the threshold requirement agreed upon in the combined certificate, the signature result is determined to be valid.

[0071] It should be noted that by verifying the legality, validity period, revocation status, and compliance of the signature policy of the combined certificate, the validity of the authorization source is confirmed first, avoiding subsequent signature verification based on invalid certificates, thus ensuring the credibility of the verification conclusion from the source.

[0072] The signature parsing process splits and combines signature values ​​in a preset order, and locates the valid unilateral signature and its corresponding public key by combining the participant order identifier or placeholder information in the signature object. This is both compatible with lightweight parsing of the default public key order in two-party scenarios and adaptable to the complex situation of flexible changes in participants in multi-party threshold scenarios. The verification end does not need to know the actual signer in advance, and can complete the accurate location of the valid signature only by using the information carried by the signature object itself.

[0073] The reconstruction process of the signature base message and the combined message fully reuses the combined layer encoding rules of the signature side. It generates consistent verification input based on three identical elements: combined certificate hash, public session binding value, and message digest to be verified. This ensures that the verification benchmark is completely aligned with the signature benchmark. This is the core premise that the standard post-quantum signature algorithm can directly complete the verification.

[0074] The signature verification process directly calls the native standard quantum signature verification interface, without the need for customized modification of the algorithm kernel. It is completely consistent with the conventional single signature verification process, which greatly reduces the adaptation and deployment costs of the verification end. At the same time, it relies on the mature security system of the standardized algorithm to ensure the reliability of the verification logic.

[0075] Ultimately, the threshold requirements agreed upon in the composite certificate are used as the criterion for verification success, rather than requiring all participants' signatures to pass. This corresponds to the threshold fault tolerance mechanism on the signing side, which not only adapts to flexible multi-party authorization business scenarios but also strictly follows the authorization constraints of the composite certificate, ensuring the consistency of the authorization rules in the execution of both the signing and verification sides.

[0076] In one specific implementation, Example 1, online collaborative signature based on ML-DSA: System initialization: Selected algorithm suite: CBCMSIG-MLDSA65-MLDSA65-SHA512.

[0077] Set parameters: Prefix="CertificateBoundCompositePQCSignatures", Label="CBCMSIG-MLDSA65-MLDSA65-SHA512".

[0078] The pre-hash function PH uses SHA-512.

[0079] Key generation and registration: PartyA generates an ML-DSA key pair (pub) A ,prv A ).

[0080] PartyB generates an ML-DSA key pair (pub) B ,prv B ).

[0081] Both parties generated a CSR through two rounds of interaction: PartyA sent the main information and the public... A The request strategy is given to PartyB; PartyB generates a pub. B Construct CertificationRequestInfo and calculate M rep Generate sig B PartyA verifies sig B SIG is then generated. A , combination sig AB Submit a CSR.

[0082] CA issues combined certificates. AB Includes subject, algorithm_suite, and pub A pub B 、policy="2-of-2".

[0083] Online Signature Agreement: PartyA: Sampling r A Calculate c A =H commit ("composite-sign-commit-v1",Part A ,cert hash ,ts A ,msg hash ,r A ), send ts A ,msg hash ,c A .

[0084] PartyB: Sampling r B Calculate c B =H commit (...), send ts B ,c B .

[0085] PartyA: Calculate sess hash =H sessionauth (c A ,c B ,r A), generate sess rep , using prv A Signature is obtained Asess Send r A ,sign Asess .

[0086] PartyB: Verify sign Asess Calculate rho=H session (c A ,c B ,r A ,r B ), construct M core =Encode("online-composite-core-v1",cert hash ,ts A ,ts B ,rho,msg hash ), generate M rep , using prv B Signature to get sig B Send r B ,sig B .

[0087] PartyA: Verify c B and sig B Generate sig A , combination sig AB =sig A ||sig B Output msig AB .

[0088] verify: Obtain the combined signature result to be verified, the corresponding combined certificate, and the message digest; Verify the validity of the combined certificate, including the certificate chain, validity period, revocation status, and signature policy; The first public key, the second public key, and the algorithm suite are parsed from the combined certificate; The combined signature value is parsed from the signature result and decomposed into a first unilateral signature and a second unilateral signature; Based on the public session binding value, timestamp, and message digest in the signature result, the signature base message is reconstructed, and a composite message representative is generated through the composition layer. The first public key and the second public key are used to perform standard post-quantum signature verification on the combined message representative and the corresponding unilateral signature, respectively. The signature result is considered valid only if both unilateral signatures are verified.

[0089] In another specific implementation: a variant based on FN-DSA. The unilateral signature algorithm uses the Fast Fourier Transform (FN-DSA) compact signature algorithm, and the signature mode employs an asynchronous countersigning variant, eliminating the need for real-time online interaction between the two parties. This is suitable for business scenarios involving sequential approval and hierarchical signing. The system establishment and certificate issuance logic remain consistent with the above implementation method; the core difference lies in the signature generation process and the message reconstruction rules during verification.

[0090] System initialization Selected algorithm suite: CBCMSIG-FNDSA512-FNDSA512-SHA512.

[0091] Set parameters: Prefix="CertificateBoundCompositePQCSignatures", Label="CBCMSIG-FNDSA512-FNDSA512-SHA512".

[0092] The pre-hash function PH uses SHA-512, and in the case of countersigning, rep... tag They are labeled "countersign-party-a" and "countersign-party-b" respectively to distinguish the different signature contexts of the two parties.

[0093] Key generation and registration PartyA generates an FN-DSA key pair (pub) A ,prv A ).

[0094] PartyB generates an FN-DSA key pair (pub) B ,prv B ).

[0095] Both parties generate a Certificate Request (CSR) through two rounds of interaction: PartyA sends the subject information and public... A The request strategy is given to PartyB; PartyB generates a pub. B Construct CertificationRequestInfo, calculate the corresponding combined message representative and generate sig B PartyA verifies sig B SIG is then generated. A , combination sig AB As a signature of the CSR request, it is submitted to the Certificate Authority (CA). The CA issues a combined certificate. AB Includes subject and algorithm suite pub A pubB 、policy="2-of-2".

[0096] Online Signature Agreement: PartyA: Sample rA, calculate cA=Hcommit("composite-sign-commit-v1",PartA,certhash,tsA,msghash,rA), and send tsA,msghash,cA.

[0097] PartyB: Samples rB, sends tsB,rB.

[0098] PartyA: Mcore=Encode("online-composite-core-v1",certhash,tsA,tsB,rho,msghash), generate Mrep, sign it with prvA to get sigA, and send rA,sigA.

[0099] PartyB: Constructs Mcore=Encode("online-composite-core-v1",certhash,tsA,tsB,rho,msghash), generates Mrep, verifies the correctness of sigA, signs it with prvB to obtain sigB, and sends sigB, or combines sigAB=sigA||sigB, outputting msigAB. PartyA: Verify sigB, combine sigAB=sigA||sigB, and output msigAB.

[0100] In this protocol, B does not use a random number commitment method, but directly publishes a random number rB. However, the protocol requires A to generate a component signature first, and B to verify the signature before generating a signature sigB. B can also terminate the execution of the protocol without sending the signature sigB to A.

[0101] Countersigned Agreement PartyA: Retrieve the message digest (msg) to be signed hash Record local timestamps (ts) A Construct the first signature base message M coreA =Encode("countersign-core-v1-a",cert hash ,ts A ,msg hash The first combined message representative M is generated through the combination layer. repA =Prefix||Label||len(rep_tag)||"countersign-party-a"||len(ctx)||ctx||PH(McoreA Using prv A For M repA Perform the standard FN-DSA signature to obtain the first unilateral signature sig. A ; will ts A sig A Send to PartyB.

[0102] PartyB: Receives sig A Then, use pub A Verify the validity of the first unilateral signature; upon successful verification, record the local timestamp ts. B Construct the second signature base message M coreB =Encode("countersign-core-v1-b",cert hash ,ts B ,msg hash ,sig A The second combined message representative M is generated through the combination layer. repB =Prefix||Label||len(rep tag )||"countersign-party-b"||len(ctx)||ctx||PH(M coreB Using prv B For M repB Perform the standard FN-DSA signature to obtain the second unilateral signature sig. B ; will ts B sig B Send to PartyA.

[0103] PartyA: Receives sig B Then, use pub B Verify the validity of the second unilateral signature; after successful verification, assign the signature to the public keys in the combined certificate according to their order. A with sig B The combined signature value sig is obtained by concatenation. AB =sig A ||sig B Output the combined signature result msig AB The object must contain at least cert hash ts A ts B sig AB .

[0104] verify Obtain the combined signature result to be verified, the corresponding combined certificate, and the message digest; Verify the validity of the combined certificate, including the certificate chain, validity period, revocation status, and signature policy; The first public key, the second public key, and the algorithm suite are parsed from the combined certificate; the combined signature value is parsed from the signature result, decomposed into the first unilateral signature and the second unilateral signature, and the timestamps and certificate hashes of both parties are extracted. Reconstruct the basic signature messages separately: Reconstruct the first basic signature message based on the certificate hash, the first timestamp, and the message digest to generate the first combined message representative; Reconstruct the second basic signature message based on the certificate hash, the second timestamp, the message digest, and the first unilateral signature to generate the second combined message representative; The first public key is used to perform standard FN-DSA verification on the first combined message representative and the first unilateral signature, and the second public key is used to perform standard FN-DSA verification on the second combined message representative and the second unilateral signature. The signature result is considered valid only if both unilateral signatures are verified.

[0105] As an example, this scheme enables multi-party collaborative signatures based on post-quantum identifier signatures.

[0106] This embodiment presents an alternative implementation of the architecture, replacing the underlying signature primitives with a post-quantum identifier signature algorithm and replacing the PKI certificate system with an identifier cryptography system. It enables multi-party threshold collaborative authorization without the need for issuing composite certificates, making it suitable for certificate-less authentication scenarios. The interaction flow, composite message representative generation rules, and threshold verification logic of the collaborative protocol in this embodiment are completely consistent with the aforementioned online protocol and countersigning protocol. The core difference lies in the replacement of the identity credential system and the underlying signature algorithm.

[0107] System initialization and identity key generation Established by the trusted key generation center execution system: Based on a preset parameter set, a global master public key and a master private key are generated using a ring NTRU trapdoor generation algorithm. The master private key is a trapdoor basis that satisfies the ring constraint of the complex embedded domain, and the master public key is derived from the trapdoor basis and is used as a globally public parameter.

[0108] Each participant is assigned a unique target identity identifier. The key generation center generates an identifier signature key pair corresponding to the identity based on the master private key, master public key, and target identity identifier. The target identity identifier is reversibly mapped to obtain a reversible public polynomial on the ring. The identifier signature key pair contains two sets of short polynomials. The two sets of short polynomials, the master public key, and the public polynomials satisfy a preset congruence relationship.

[0109] Configure a multi-party threshold signature policy, specifying the total number of participants and the number of signature thresholds. This policy, together with the global master public key and the set of participant identity identifiers, serves as the authorization verification benchmark, replacing the identity binding and policy constraint functions of the combined certificate.

[0110] Participants meeting the threshold number of participants perform collaborative signatures according to the online commitment protocol in Example 1, with the core difference being: Each participant generates a local random number and a commitment value. After completing the exchange of the global commitment set and session identity authentication, a unified public session binding value is calculated based on the global commitment set and all valid local random numbers.

[0111] By combining the global master public key identifier, the set of participant identity identifiers, the public session binding value, and the message digest of the message to be signed, a basic signature message is constructed; a unified composite message representative is generated through composite layer encoding.

[0112] Each participant uses its own identifier signature key pair to perform a post-quantum identifier signature operation on the combined message representative to obtain the corresponding component signature. During the signing process, the public polynomial is first normalized to obtain normalized public coefficients, and then the commitment value is generated through the normalized public coefficients and the commitment is verified to restore consistency. The component signature is generated using a bimodal rejection sampling protocol.

[0113] All valid component signatures are aggregated according to the preset identity arrangement order to generate a combined signature value; the master public key identifier, session identifier and combined signature value are combined to perform standardized encoding to generate the final signature result.

[0114] The verifier performs the following verification steps: Obtain the signature result to be verified, the global master public key, the identity identifier set of the corresponding participants, and the message digest of the message to be verified, and verify the validity of the signature policy and threshold rules.

[0115] Based on the target identity identifiers of each participant, the invertible public polynomials on the corresponding rings are derived, and the normalized public coefficients for verification are calculated. At the same time, the combined signature value and the public session binding value are parsed from the signature results, and the component signatures corresponding to each position are obtained by splitting them according to the preset identity order.

[0116] Based on the master public key identifier, identity identifier set, public session binding value and message digest, the signature base message is reconstructed to generate the corresponding combined message representative.

[0117] Using the normalized public coefficients corresponding to each participant, post-quantum signature verification is performed on the signatures of the combined message representative and the corresponding component; when the number of valid component signatures that pass verification meets the agreed threshold requirement, the signature result is determined to be valid.

[0118] Reference Figure 4In one embodiment of this application, a multi-party collaborative signature method is also proposed. This method achieves certificate-free collaborative authorization through a message recovery signature mode, involving multiple parties. A threshold number of parties collaboratively execute the signature protocol, and includes the following steps: S410, Obtain the system master public key and system master private key from the key generation center, as well as the post-quantum signature key pairs of each participant; wherein, each participant's user public key is split into a recoverable part and an explicit part; S420, The key generation center generates a combined identity binding signature using the message recovery signature mode; the recoverable part of the combined identity binding signature carries the recoverable part of the public key of the first party in the order, and the explicit part includes user identity information, the explicit part of the first party's public key, the complete public keys of other parties, and the collaborative signature strategy. S430. Each participant performs the signing in a preset order. The user signature generated by the participant at the beginning of the order has a recoverable portion that carries the recoverable portion of the public key of the next participant, and an explicit portion that includes the signing context. The user signature generated by the participant at the end of the order has a recoverable portion that carries the recoverable portion of the message to be signed, and an explicit portion that includes the explicit portion of the message to be signed. S440. Assemble the combined identity binding signature, the explicit portion of the public keys of all participants, the complete public keys of non-participants, the signatures of all participants, and the explicit portion of the message to be signed to generate a signature result.

[0119] It should be noted that this embodiment is a certificateless alternative to a certificate-bound multi-party collaborative signature system. It uses quantum signature after message recovery as the underlying primitive and relies on a trusted key generation center to complete identity authorization. It replaces the identity binding and policy constraint functions of combined certificates. Without changing the core architecture of multi-party threshold collaborative authorization, it is adapted to the application scenarios of certificateless identity cryptography systems and can be directly integrated into the identity-based post-quantum cryptography application system without the need to build a complete PKI certificate infrastructure.

[0120] The core design for adapting message recovery signature carrying capabilities is to split the public keys of each participating party into recoverable and explicit parts. Implicitly transmitting a portion of the public key value within the recoverable field of the signature, rather than explicitly carrying it entirely, compresses the overall size of the collaborative signature transmission object, adapting to bandwidth-constrained terminal deployment scenarios. The public key splitting follows reversible concatenation rules, ensuring that all cryptographic properties of the original public key can be fully restored after recovery, without affecting the correctness and security strength of subsequent signature verification.

[0121] The composite identity binding signature replaces the trusted authorization carrier function of the composite certificate. It is issued by the key generation center based on the system's master private key and is unforgeable. Its recoverable part hides the recoverable fragment of the public key of the first participant, while the explicit part carries all identity information, explicit fragments of the public key, and the collaborative signature policy. This not only enables the key generation center to authoritatively authenticate the collaborative permissions of multiple parties, but also reduces the transmission overhead of identity credentials through the message recovery mechanism, and completes the binding constraint of identity and policy without issuing a full-format digital certificate.

[0122] The signature generation logic employs a chain-nested recovery mechanism, embedding the recoverable portion of the public key of the next participant into the current signature sequentially according to a preset arrangement. The final signature carries the recoverable portion of the message, forming a unidirectional trusted chain: "identity credential → first public key → sequential recovery of all public keys → final recovery of the complete message." This design deeply integrates public key distribution with signature generation, eliminating the need to pre-distribute all participants' complete public keys. The verification end can recover all identity credentials and message content level by level simply by transmitting the object itself. Simultaneously, each signature level is strongly bound to the identity of the next level, ensuring the continuous and trustworthy authorization chain of collaborative signatures and preventing security risks such as identity impersonation, tampering with public keys or messages in intermediate stages.

[0123] The system assembles identity credentials, explicit public key fragments, user signatures at all levels, and explicit message fragments according to a unified structured format to generate the final signature result. This output architecture maintains the same design as the signature result format of the certificate binding scheme. The verification end can reuse the unified parsing framework. It only needs to replace the certificate validity verification with the master public key verification of the key generation center to complete the compatibility verification of the two schemes, reducing the system integration and maintenance costs in multi-system integration scenarios.

[0124] In one embodiment of this application, the collaborative signature strategy supports 2-of-2 and t-of-n threshold authorization configurations; The explicit portion of the combined identity binding signature also includes a domain separation tag and a timestamp; The participating parties include one or more of the following: mobile terminals, cloud servers, and hardware security modules.

[0125] It should be noted that different modes such as 2-of-2 and t-of-n can be flexibly selected according to the business authorization strength: the 2-of-2 mode is suitable for strongly bound dual-subject authorization scenarios such as end-to-end cloud dual signature and dual-person review, and the two-party collaboration logic is completely the same as that of the certificate binding solution; the t-of-n mode is suitable for multi-node distributed decision-making, multi-department countersigning and other multi-party authorization scenarios, and only the policy configuration needs to be adjusted to take effect, without modifying the core signature protocol and recovery verification process, thus balancing authorization flexibility and architectural stability.

[0126] Domain separation label and timestamp are optional security enhancement fields: The domain separation label is used to distinguish the signature context of different business scenarios and different protocol versions, avoiding the risk of cross-protocol attacks caused by the reuse of the same key pair in multiple scenarios, forming a double layer of protection with the domain separation design of the combination layer encoding; The timestamp can record the timing information of signature issuance, which can be used to resist replay attacks and also support signature validity verification and full-link audit traceability, meeting the time dimension control requirements in compliance scenarios.

[0127] Participants support multiple deployment carriers, and the underlying key generation and message recovery signature operations do not depend on a specific operating environment: mobile terminals are adapted for user-side interactive signature scenarios, cloud servers are adapted for backend automated signature scenarios, and hardware security modules can further improve the security level of private key storage and signature operations; different types of participants can form a mixed network to participate in collaborative signatures without the need for a unified hardware form, adapting to full-level deployment needs from consumer-grade terminals to high-security-level servers.

[0128] In one specific implementation, the combined identity binding signature cert_comb (issued by KGC): Message Restore Mode (MRM) can recover a portion of M1 stored in pk1. r The explicit part M2 contains ID||pk1 e ||pk2||policy||tag||timestamp.

[0129] User message signature σ1 (generated on mobile): MRM mode, partial recovery of M1 stored in pk2 r The explicit part M2 contains the complete message m.

[0130] User message signature σ2 (cloud-generated): MRM mode, partially recoverable from M1 stored m r2 The explicit part M2 contains m r1 ||m e .

[0131] The verification process is divided into two phases: Phase 1 (Recovery): Extract the recoverable portion directly from the signature; complete verification is not required.

[0132] Phase 2 (Full Verification): Once all dependency information is ready, perform a full verification on each signature.

[0133] Registration phase User key generation: Mobile device generates (sk1, pk1), cloud device generates (sk2, pk1). 2) Each public key is split: Pk1=pk1 r ||pk1 e Pk2=pk2r ||pk2 e Submit registration: The user will submit (ID, pk1) r pk1 e pk2 r pk2 e The policy is submitted to the KGC. After verification, the KGC issues a combined identity binding signature: cert_comb=CertSign-MRM_{sk_KGC}(M1=pk1 r M2=ID||pk1 e ||pk2||policy||tag||timestamp) Where pk2 is the complete public key (pk2) r ||pk2 e ).

[0134] KGC returns cert_comb, which is then distributed to both ends by the user.

[0135] Signature stage The message m to be signed is split into: m r1 =First recoverable portion (explicit transmission) m r2 =Second recoverable portion (recovered by σ2) m e =Explicit part (explicit transmission, may be empty) Mobile (First-Party): σ1=UserSign-MRM_{sk1}(M1=pk2 r M2=m) Where M2 = complete message m (i.e., m) r1 ||m r2 ||m e ).

[0136] Cloud (Second-party): σ2=UserSign-MRM_{sk2}(M1=m r2 M2=m r2 ||m e ) Generate a collaboratively signed transfer object: σ CoSign =cert comb ||pk1 e ||pk2 e ||σ1||σ2||m r1 ||m e If the verifier does not know the identity, then an ID is appended.

[0137] Verification process (two phases: recovery first, then full verification) The verifier holds the PK. KGC Received σ CoSign back: Phase 1: Recovery Restore pk1: For cert comb Perform MRM recovery operation and extract the recoverable portion PK1. r , with explicit pk1 e , to piece together the complete pk1.

[0138] Recovery pk2: Perform an MRM recovery operation on σ1 using pk1, extract the recoverable portion pk2^(r), and compare it with the explicit pk2. e The complete pk2 is pieced together.

[0139] Restore m r2 Use pk2 to perform MRM verification on σ2. After successful verification, restore m. r2 Construct the complete message m=m r1 ||m r2 ||m e .

[0140] Phase Two: Full Verification Full validation of σ1: Perform full MRM validation on σ1 using pk1 and full message m, with input M2=m.

[0141] Full verification certificate comb Using PK KGC And the complete M2 (including pk2) to cert comb To perform full MRM validation, input M2=ID||pk1 e ||pk2||policy||tag||timestamp.

[0142] Reference Figure 5 In one embodiment of this application, a multi-party collaborative signature verification method is also proposed. This method is used to verify the signature result generated by any of the methods described above, and includes the following steps: S510. Obtain the system master public key of the collaborative signature transmission object to be verified and the key generation center; S520. Perform message recovery on the combined identity binding signature, extract the recoverable part of the public key of the first participant and concatenate it to obtain the complete public key; use the complete public key of the preceding step to perform message recovery on the signature of the corresponding user in a preset order, extract the recoverable part of the public key of the next participant and concatenate it to obtain the corresponding complete public key, until the complete public keys of all participants are obtained; after verifying the signature of the last user, extract the recoverable part of the message to be signed and concatenate it to obtain the complete message to be signed; S530. Perform full verification of the corresponding user signature using the complete public key of each participant, and perform full verification of the combined identity binding signature using the system master public key; S540. When the number of valid user signatures that have passed verification meets the threshold requirement of the agreed collaborative signature strategy, the collaborative signature transmission object is determined to be legal and valid.

[0143] It should be noted that this verification method is logically completely symmetrical with the aforementioned certificateless multi-party collaborative signature generation method. It uses the system's master public key from the key generation center as the global root of trust, replacing the certificate trust anchor in a certificate-based system, and fully implements the legitimacy verification of multi-party threshold collaborative signatures under a certificateless identity paradigm. The overall verification framework is derived from the certificate binding scheme, allowing for the reuse of a unified parsing and verification engine, reducing deployment and maintenance costs in multi-system integration scenarios.

[0144] Verifying input only requires holding the system master public key of the key generation center in advance. The collaborative signature transmission object to be verified contains identity credentials, signatures at all levels, and message fragments. The verification end does not need to store the complete public keys of all participants in advance, nor does it need to rely on third-party certificate directory services, making it naturally suitable for distributed and lightweight identity deployment scenarios.

[0145] The chain-based recovery process employs a progressive recovery logic: First, the recoverable portion of the first participant's public key is extracted from the combined identity binding signature and concatenated with the explicit portion to obtain the complete public key. Then, based on this public key, message recovery is performed on the corresponding user signature, extracting the recoverable portion of the next participant's public key and concatenating it to obtain the corresponding complete public key. This process is repeated until the complete public keys of all participants are restored. Finally, the recoverable portion of the message to be signed is recovered from the last user's signature, and the complete message to be signed is concatenated. This design deeply integrates public key distribution and signature transmission, eliminating the need to explicitly carry all complete public keys in the transmission object, effectively compressing the transmission volume. Furthermore, the public key recovery process only performs message extraction operations and does not perform complete signature verification immediately. This allows the verification end to quickly obtain the participant's identity and message content before performing complete verification as needed, adapting to step-by-step processing scenarios such as permission pre-checking and message pre-parsing.

[0146] The complete verification process is executed uniformly after all public keys and messages have been recovered: the combined identity-bound signature undergoes full verification using the system's master public key to confirm the legitimacy of the identity authorization and the validity of the collaborative signature strategy; each participant's user signature undergoes full verification using the corresponding recovered complete public key to confirm the authenticity of the signature itself and the immutability of the message. This post-full verification avoids intermediate anomalies during the recovery process from affecting the final conclusion. The legitimacy of all signatures is natively verified using the standard message recovery signature algorithm, requiring no custom verification logic and ensuring full compatibility with the standard post-quantum message recovery verifier.

[0147] Ultimately, the agreed-upon collaborative signature strategy serves as the criterion for judgment. A signature is deemed valid only if the number of verified valid user signatures meets a threshold requirement, rather than forcing all participants to sign. This aligns with the threshold-based fault tolerance mechanism on the generation side, adapting to flexible multi-party authorization scenarios while strictly adhering to the authorization constraints issued by the key generation center, ensuring consistency in the authorization rules on both the generation and verification sides. Furthermore, the correctness of the chained recovery is guaranteed by subsequent complete verification. Even if the transmitted object is tampered with, causing public key or message recovery anomalies, subsequent complete signature verification will fail, balancing transmission efficiency and security strength.

[0148] Result determination: If all the above steps are successful, the confirmation message is jointly signed by the user corresponding to the ID using two keys, and the collaboration policy is satisfied. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple; relevant details can be found in the description of the method embodiment.

[0149] Reference Figure 6 This illustration shows a multi-party collaborative signature apparatus according to an embodiment of the present application, the apparatus implementing the steps of the post-quantum identifier signature method described in any of the preceding claims: include: The acquisition module 610 is used to acquire post-quantum signature key pairs from several participating parties; wherein, the participating parties hold corresponding private keys and public keys; The combined certificate module 620 is used to bind all the public keys to the same subject to generate a combined certificate; wherein the combined certificate carries a signature policy jointly authorized by all the participating parties; The combined signature value module 630 is used to generate a combined signature value by having the participating parties, who meet a threshold number, collaboratively execute an online signature protocol according to the signature strategy. The signature result module 640 is used to generate a signature result based on the combined certificate and the combined signature value.

[0150] In one embodiment of the present invention, the acquisition module 610 includes: The signature key pair submodule is used by the participating parties to independently generate post-quantum signature key pairs locally, obtaining a one-to-one corresponding private key and public key; The custody submodule is used by the participating parties to perform local secure custody of the generated private key; The limiting submodule is used to limit the signature key pair to a signature scenario specifically for the corresponding combined certificate.

[0151] In one embodiment of the present invention, the combined certificate module 620 includes: The arrangement submodule is used to arrange the public keys of all the participants according to a preset rule to obtain an ordered set of public keys; The composite certificate submodule is used to bind all public keys to the same certificate subject through the ordered public key set, configure a signature policy jointly authorized by multiple parties, and generate a composite certificate. The unique identifier submodule is used to perform a hash operation on the standard encoding result of the combined certificate to obtain the combined certificate hash as the unique identifier of the certificate.

[0152] In one embodiment of the present invention, the combined signature value module 630 includes: The global commitment set submodule is used by the participating parties to generate local random numbers and corresponding commitment values, and to exchange the commitment values ​​of each participating party through multiple rounds of interaction to obtain the global commitment set. The protocol determination submodule is used to verify all the participants based on the global commitment set. Specifically, each participant discloses a local random number corresponding to its commitment value, and the consistency between the participant's commitment value and the corresponding random number is verified. If the verification fails, the corresponding participant is excluded from the protocol. If the number of participants that pass the verification does not meet the threshold requirement of the signature policy, the protocol is terminated. The public session binding value submodule is used to obtain a unified public session binding value by the global commitment set and the local random number of the participating parties after the verification passes. The signature base message submodule is used to obtain the signature base message through the public session binding value and the message digest of the message to be signed; The unilateral signature submodule is used to generate a unified combined message representative based on the signature base message. The participating parties that meet the threshold number of participants sign the combined message representative using their corresponding private keys to obtain the corresponding unilateral signature. The combined signature value generation submodule is used to generate a combined signature value based on all the unilateral signatures.

[0153] In one embodiment of the present invention, the combined signature value module 630 further includes: The session authentication message representative submodule is used by the participants to generate session authentication messages sequentially based on the global commitment set and the session context, and obtain the session authentication message representative through a combination layer encoding. The cross-validation submodule is used by the participating party to obtain a session authentication signature by signing the session authentication message representative with its own private key, and to complete cross-validation through the session authentication signature. The content confirmation submodule is used to confirm the authenticity and validity of the participant's identity and the content of the commitment interaction when all the session authentication signatures of the participants to be signed have been verified.

[0154] In one embodiment of the present invention, the unilateral signature submodule includes: A complete encoded message unit is used to concatenate the signature base message with the algorithm suite identifier, fixed prefix, scene label, and context information in a pre-defined order to obtain a complete encoded message. The combined message representative unit is used to perform a pre-hash operation on the complete encoded message and output a combined message representative in a unified format.

[0155] In one embodiment of the present invention, the multi-signature result module 640 includes: The session identifier submodule is used to extract the combined certificate hash as the certificate identifier and extract the public session binding value as the session identifier. The basic signature dataset submodule is used to assemble the certificate identifier, the session identifier, and the combined signature value according to a preset data structure to obtain the basic signature dataset; A supplementary submodule is used to supplement the participant identification information in the basic signature dataset when the signature strategy is a multi-party threshold strategy. The signature result generation submodule is used to perform standardized encoding on the basic signature dataset to generate signature results.

[0156] In one embodiment of this application, a multi-party collaborative signature device is also proposed. The method is executed through a sequential countersigning mode, with the participation of several parties. A threshold number of parties collaboratively execute the countersigning protocol, including: The second acquisition module is used to acquire post-quantum signature key pairs from several participating parties; wherein, the participating parties hold corresponding private keys and public keys; The second combined certificate module binds all the public keys to the same subject to generate a combined certificate; wherein, the combined certificate carries a signature policy jointly authorized by all the participating parties; The second combined signature value module is used to generate a combined signature value by having the participating parties, meeting a threshold number, collaboratively execute a countersigning protocol according to the signature strategy. Specifically, the participating parties determine the signing order according to the preset arrangement of public keys in the combined certificate. The participating parties construct a basic signature message based on the combined certificate hash, their own timestamp, the message digest of the previous signature and the message to be signed, according to the signing order. They then generate a combined message representative through combined layer encoding, sign the combined message representative using their own private key to obtain a unilateral signature, and send the unilateral signature to the next adjacent participating party until all participating parties have completed signing. When all participating parties have completed signing, all valid unilateral signatures are aggregated according to the preset arrangement to generate a combined signature value. The second signature result module is used to generate a signature result based on the combined certificate and the combined signature value.

[0157] Reference Figure 7 This illustrates a multi-party collaborative signature verification device provided in an embodiment of this application: include: The pre-verification module 710 is used to obtain the multi-party signature result to be verified, the corresponding combined certificate and the message digest of the message to be verified, and to verify the validity of the combined certificate; The splitting module 720 is used to obtain the public keys and algorithm suite information of all participants based on the combined certificate, and to obtain the combined signature value, public session binding value and combined certificate hash through the signature result, and to split the combined signature value in a preset order to obtain the unilateral signature corresponding to each position. Extraction module 730 is used to determine the valid unilateral signature and its valid corresponding public key in the composite certificate by using the participant sequence identifier or placeholder information in the signature result; The combined message representative module 740 is used to reconstruct the signature base message based on the combined certificate hash, the public session binding value and the message digest, and generate the corresponding combined message representative; The determination module 750 is used to perform standard post-quantum signature verification on the combined message representative and the corresponding valid unilateral signature using the valid corresponding public key. When the number of valid unilateral signatures that pass the verification meets the threshold requirement agreed upon by the combined certificate, the signature result is determined to be valid.

[0158] In one embodiment of this application, a multi-party collaborative signature device is also proposed. This device implements certificate-free collaborative authorization through a message recovery signature mode, involving multiple parties. A threshold number of parties collaboratively execute the signature protocol, including: The third acquisition module is used to acquire the system master public key and system master private key of the key generation center, as well as the post-quantum signature key pair of each participant; among them, the user public key of each participant is split into a recoverable part and an explicit part; The third combined identity binding signature module is used by the key generation center to generate a combined identity binding signature using the message recovery signature mode; the recoverable part of the combined identity binding signature carries the recoverable part of the public key of the first party in the order, and the explicit part includes user identity information, the explicit part of the first party's public key, the complete public keys of other parties, and the collaborative signature strategy. The third signature execution module is used by each participant to execute signatures sequentially according to a preset order. The user signature generated by the participant at the beginning of the sequence has a recoverable portion that carries the recoverable portion of the public key of the next participant, and an explicit portion that includes the signature context. The user signature generated by the participant at the end of the sequence has a recoverable portion that carries the recoverable portion of the message to be signed, and an explicit portion that includes the explicit portion of the message to be signed. The third signature result module is used to assemble the combined identity binding signature, the explicit part of the public key of all participants, the complete public key of non-participants, the signatures of all participants and the explicit part of the message to be signed, to generate a signature result.

[0159] In one embodiment of the present invention, a multi-party collaborative signature verification device is also proposed, comprising: The fourth acquisition module is used to acquire the collaborative signature transmission object to be verified and the system master public key of the key generation center; The concatenation module is used to perform message recovery on the combined identity binding signature, extract the recoverable part of the public key of the first participant and concatenate it to obtain the complete public key; sequentially use the complete public key of the preceding step to perform message recovery on the signature of the corresponding user in a preset order, extract the recoverable part of the public key of the next participant and concatenate it to obtain the corresponding complete public key, until the complete public keys of all participants are obtained; after verifying the signature of the last user, extract the recoverable part of the message to be signed and concatenate it to obtain the complete message to be signed; The full verification module is used to perform full verification of the corresponding user signature using the full public keys of each participant, and to perform full verification of the combined identity binding signature using the system master public key; The determination module is used to determine that the collaborative signature transmission object is legal and valid when the number of valid user signatures that have passed verification meets the threshold requirements of the agreed collaborative signature strategy.

[0160] Reference Figure 8 The diagram illustrates a computer device for implementing a multi-party collaborative signature method of the present invention, which may specifically include the following: The aforementioned computer device 1 is in the form of a general-purpose computing device. The components of the computer device 1 may include, but are not limited to: one or more processors or processing units 3, memory 8, and a bus 4 connecting different system components (including memory 8 and processing unit 3).

[0161] Bus 4 represents one or more of several bus architectures, including memory buses or memory controllers, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Audio / Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0162] Computer device 1 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 1, including volatile and non-volatile media, removable and non-removable media.

[0163] Memory 8 may include computer system readable media in the form of volatile memory, such as random access memory 9 and / or cache memory 10. Computer device 1 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 11 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Although Figure 6 As not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 4 via one or more data media interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 13 configured to perform the functions of the embodiments of this application.

[0164] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in memory. Such program modules 13 include—but are not limited to—an operating system, one or more application programs, other program modules 13, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 13 typically perform the functions and / or methods described in the embodiments of this application.

[0165] Computer device 1 can also communicate with one or more external devices 2 (e.g., keyboard, pointing device, monitor 7, camera, etc.), and with one or more devices that enable an operator to interact with computer device 1, and / or with any device that enables computer device 1 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through I / O interface 6. Furthermore, computer device 1 can communicate with one or more networks (e.g., local area network (LAN)), wide area network (WAN), and / or public networks (e.g., the Internet) through network adapter 5, and can also exchange data via medical data network protocols such as ICD protocol, DICOM protocol, and HL7 protocol. Figure 8 As shown, network adapter 5 communicates with other modules of computer device 1 via bus 4. It should be understood that, although... Figure 8 Not shown, it can be combined with computer device 1 to use other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processing unit 3, external disk drive array, RAID system, tape drive and data backup storage system 11, etc.

[0166] The processing unit 3 executes various functional applications and data processing by running programs stored in memory 8, such as implementing a multi-party collaborative signature method provided in the embodiments of this application.

[0167] That is, when the above-mentioned processing unit 3 executes the above-mentioned procedure, it achieves the following: obtaining the post-quantum signature key pairs of several participating parties; wherein, the participating parties hold the corresponding private key and public key; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; Based on the signature strategy, the participating parties, meeting a threshold number, collaboratively execute the online signature protocol to generate a combined signature value; A signature result is generated based on the combined certificate and the combined signature value.

[0168] In this application embodiment, the application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a multi-party collaborative signature method as provided in all embodiments of the application.

[0169] That is, when the program is executed by the processor, it achieves the following: obtaining post-quantum signature key pairs from several participating parties; wherein, the participating parties hold corresponding private keys and public keys; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; Based on the signature strategy, the participating parties, meeting a threshold number, collaboratively execute the online signature protocol to generate a combined signature value; A signature result is generated based on the combined certificate and the combined signature value.

[0170] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0171] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0172] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the operator's computer, partially on the operator's computer, as a standalone software package, partially on the operator's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the operator's computer via any type of network—including a local area network (LAN) or wide area network (WAN) that is compatible with medical network standards such as HL7 for HIS, RIS, and LIS systems—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider). The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably.

[0173] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0174] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0175] The above provides a detailed description of the multi-party collaborative signature method, verification method, and apparatus provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A multi-party collaborative signature method, characterized in that, The method involves several parties, with a threshold number of parties collaboratively executing the signature protocol, including the following steps: Obtain post-quantum signature key pairs from several participating parties; wherein each participating party holds a corresponding private key and public key; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; Based on the signature strategy, the participating parties, meeting a threshold number, collaboratively execute the online signature protocol to generate a combined signature value; A signature result is generated based on the combined certificate and the combined signature value.

2. The method according to claim 1, characterized in that, The step of obtaining post-quantum signature key pairs from several participating parties, wherein each participating party holds a corresponding private key and public key, includes: The participating parties independently generate quantum signature key pairs locally, obtaining a one-to-one corresponding private key and public key; The participating parties shall perform local secure storage of the generated private key; The signature key pair is limited to signature scenarios specifically used for the corresponding combined certificate.

3. The method according to claim 1, characterized in that, The step of binding all the public keys to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties, includes: Arrange all the public keys of the participating parties according to a preset rule to obtain an ordered set of public keys; By binding all public keys to the same certificate subject through the ordered public key set and configuring a signature policy jointly authorized by multiple parties, a composite certificate is generated. A hash operation is performed on the standard encoding result of the combined certificate to obtain the combined certificate hash as the unique identifier of the certificate.

4. The method according to claim 1, characterized in that, The step of generating a combined signature value by having participating parties collaboratively execute an online signature protocol according to the signature policy and meeting a threshold number of participants includes: The participants generate local random numbers and corresponding commitment values, and exchange the commitment values ​​of each participant through multiple rounds of interaction to obtain a global commitment set. All participants are verified based on the global commitment set. Specifically, each participant discloses a local random number corresponding to its commitment value, and the consistency between the participant's commitment value and the corresponding random number is verified. If the verification fails, the corresponding participant is excluded from the protocol. If the number of participants that pass the verification does not meet the threshold requirement of the signature policy, the protocol is terminated. After the verification is passed, the participants that meet the threshold number obtain a unified public session binding value through the global commitment set and the local random number; The signature base message is obtained by combining the public session binding value with the message digest of the message to be signed. Based on the signature base message, a unified combined message representative is generated. Each participating party that meets the threshold number of participants signs the combined message representative using its corresponding private key to obtain the corresponding unilateral signature. Generate a combined signature value based on all the unilateral signatures.

5. The method according to claim 4, characterized in that, It also includes session authentication, including the following steps: The participating parties sequentially generate session authentication messages based on the global commitment set and the session context, and obtain a representative session authentication message through a combination layer encoding. The participating party obtains a session authentication signature by signing the session authentication message representative with its own private key, and completes cross-validation through the session authentication signature; When the session authentication signatures of all participating parties to be signed are verified, the identity of the participating parties and the content of the commitment interaction are confirmed to be true and valid.

6. The method according to claim 4, characterized in that, The step of generating a unified combined message representative based on the signature base message includes: The signature base message is concatenated with the algorithm suite identifier, fixed prefix, scene label, and context information in a pre-defined order to obtain the complete encoded message; Perform a pre-hash operation on the complete encoded message to output a combined message representative in a uniform format.

7. The method according to claim 1, characterized in that, The step of generating a signature result based on the combined certificate and the combined signature value includes: Extract the combined certificate hash as the certificate identifier, and extract the public session binding value as the session identifier; The certificate identifier, the session identifier, and the combined signature value are assembled according to a preset data structure to obtain a basic signature dataset; When the signature strategy is a multi-party threshold strategy, the participating party supplements the participating party identification information in the basic signature dataset; The basic signature dataset is subjected to standardized encoding to generate signature results.

8. A multi-party collaborative signature method, characterized in that, The method is executed through a sequential countersigning mode, involving multiple parties. A threshold number of parties collaboratively execute the countersigning protocol, including the following steps: Obtain post-quantum signature key pairs from several participating parties; wherein each participating party holds a corresponding private key and public key; All the public keys are bound to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; According to the signature strategy, the participating parties, meeting a threshold number, collaboratively execute a co-signing protocol to generate a combined signature value. Specifically, the participating parties determine the signing order according to a preset arrangement of public keys in the combined certificate. Each participating party constructs a basic signature message based on the combined certificate hash, its own timestamp, the message digest of the previous signature, and the message to be signed, according to the signing order. A combined message representative is generated through combined layer encoding, and the participating party signs the combined message representative using its own private key to obtain a single-party signature. This single-party signature is then sent to the next adjacent participating party until all participating parties have completed the signing process. When all participating parties have completed their signing, all valid single-party signatures are aggregated according to the preset arrangement to generate the combined signature value. A signature result is generated based on the combined certificate and the combined signature value.

9. A multi-party collaborative signature verification method, characterized in that, The method is used to verify the signature result generated by the method according to any one of claims 1-8, and includes the following steps: Obtain the signature result to be verified, the corresponding combined certificate and the message digest of the message to be verified, and verify the validity of the combined certificate; Based on the combined certificate, the public keys and algorithm suite information of all participants are obtained, and the combined signature value, public session binding value and combined certificate hash are obtained through the signature result. The combined signature value is split in a preset order to obtain the individual signatures corresponding to each position. The valid unilateral signature and its corresponding valid public key in the composite certificate are determined by using the participant sequence identifier or placeholder information in the signature result. Based on the combined certificate hash, public session binding value, and message digest, the signature base message is reconstructed, and the corresponding combined message representative is generated; The combined message representative and the corresponding valid unilateral signature are verified using the valid public key. When the number of valid unilateral signatures that pass the verification meets the threshold requirement agreed upon in the combined certificate, the signature result is determined to be valid.

10. A multi-party collaborative signature method, characterized in that, The method achieves certificate-free collaborative authorization through a message recovery signature mode, involving multiple parties. A threshold number of parties collaboratively execute the signature protocol, including the following steps: Obtain the system master public key and system master private key from the key generation center, as well as the post-quantum signature key pairs of each participant; among them, each participant's user public key is split into a recoverable part and an explicit part; The key generation center uses the message recovery signature mode to generate the combined identity binding signature; the recoverable part of the combined identity binding signature carries the recoverable part of the public key of the first participant in the order, and the explicit part includes user identity information, the explicit part of the first party's public key, the complete public keys of other participants, and the collaborative signature strategy. Each participant performs the signing sequentially according to a preset order; the user signature generated by the participant at the beginning of the sequence has a recoverable portion containing the recoverable portion of the public key of the next participant, and an explicit portion containing the signing context; the user signature generated by the participant at the end of the sequence has a recoverable portion containing the recoverable portion of the message to be signed, and an explicit portion containing the explicit portion of the message to be signed. The combined identity binding signature, the explicit portions of the public keys of all participants, the complete public keys of non-participants, the signatures of all participants, and the explicit portions of the message to be signed are assembled to generate a signature result.

11. The method according to claim 10, characterized in that, The collaborative signature strategy supports 2-of-2 and t-of-n threshold authorization configurations. The explicit portion of the combined identity binding signature also includes a domain separation tag and a timestamp; The participating parties include one or more of the following: mobile terminals, cloud servers, and hardware security modules.

12. A multi-party collaborative signature verification method, characterized in that, The method is used to verify the signature result generated by the method according to any one of claims 10-11, and includes the following steps: Obtain the collaborative signature transmission object to be verified and the system master public key of the key generation center; Message recovery is performed on the combined identity binding signature, extracting the recoverable part of the public key of the first participant and concatenating them to obtain the complete public key; The message is recovered by sequentially using the complete public key of the preceding user in a preset order. The recoverable part of the public key of the next participant is extracted and concatenated to obtain the corresponding complete public key, until the complete public keys of all participants are obtained. After verifying the signature of the last user, the recoverable part of the message to be signed is extracted and concatenated to obtain the complete message to be signed. Perform full verification of the corresponding user signature using the complete public key of each participant, and perform full verification of the combined identity binding signature using the system master public key; When the number of valid user signatures that pass verification meets the threshold requirement of the agreed collaborative signature policy, the collaborative signature transmission object is determined to be legal and valid.

13. A multi-party collaborative signature device, characterized in that, The device implements the steps of the multi-party collaborative signature method as described in any one of claims 1-7: include: An acquisition module is used to acquire the post-quantum signature key pairs of several participating parties; wherein, the participating parties hold corresponding private keys and public keys; A composite certificate module is used to bind all the public keys to the same subject to generate a composite certificate; wherein the composite certificate carries a signature policy jointly authorized by all the participating parties; The combined signature value module is used to generate a combined signature value by having the participating parties collaboratively execute the online signature protocol according to the signature strategy and a threshold number of participants. The signature result module is used to generate a signature result based on the combined certificate and the combined signature value.

14. A computer electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 12.

Images