A certificateless sanitizable signature method and system with designated verifier

Abstract

The application provides a certificateless de-identification signature method and system of a designated verifier, and belongs to the technical field of cyberspace security. The method comprises the following steps: a key generation center is initialized, a de-identifier and a designated verifier key is generated, a signer key is generated, and an original directional signature is generated. The de-identifier performs de-identification calculation on sensitive information in the original directional signature according to a preset de-identification strategy, generates a de-identified signature, and sends the de-identified signature to the designated verifier. The designated verifier uses private key information in a second complete public-private key pair and public key information in a third complete public-private key pair of the signer to determine whether the de-identified signature is generated by the signer, and outputs a verification result. The three-party cryptographic protocol of "signer designation-de-identifier execution-designated verifier verification" provided by the application realizes the unity of de-identification and directional verification under a certificateless system.

Description

Technical Field

[0001] This invention belongs to the technical field of cyberspace security, specifically relating to a certificate-free, de-identified signature method and system for designating a verifier. Background Technology

[0002] In the context of the current era of internet technology and big data, the authentication and privacy protection of electronic documents have become key research areas in cyberspace security. Digital signature technology, as a core means of ensuring information integrity, authentication, and non-repudiation, has been widely applied in critical areas such as government documents, medical diagnosis, and financial transactions. However, in practical applications, digital signatures still face many problems. First, in some special scenarios, such as the issuance of documents by government and military departments, and the sharing of big data in the medical field, the signed documents may contain sensitive information. Desensitizing (modifying or deleting sensitive information) these documents before they are made public is essential. Second, most schemes are based on traditional public-key cryptography or identity-based cryptography. Traditional public-key cryptography suffers from complex certificate management issues, while identity-based cryptography faces key escrow problems.

[0003] Application CN202511352278.X discloses a lightweight certificate-free digital signature method suitable for the Internet of Things (IoT). The method includes initializing the Trust Center (KGC) parameters, constructing public parameters using a preset encryption mechanism, calculating a master public key and a master private key, receiving user identity information from the user terminal, calculating a partial private key and a partial public key using the master private key on the user identity information, generating a partial key pair and feeding it back to the user terminal, obtaining a random number from the user terminal to calculate the user's partial public key and the user's partial private key, combining the partial key pair to generate a complete key pair, feeding the complete public key of the complete key pair back to the Trust Center (KGC), signing the user terminal's message using the complete private key of the complete key pair, and sending it to a verification terminal. The verification terminal obtains the public parameters, master public key, and complete public key from the Trust Center (KGC) to verify the message signature. However, the limitations of this method lie in its overly simplistic functionality; it can only guarantee the integrity of the original message and cannot dynamically desensitize sensitive privacy information during data flow. Furthermore, any third party holding the public key can verify the signature, lacking privacy-specific features.

[0004] The invention patent with application number CN202210755230.3 proposes an attribute-based sanitizable signature scheme with server-assisted verification, which improves efficiency by sharing the verification overhead with the server; the invention patent with application number CN202210766035.0 proposes an attribute-based sanitizable signature scheme with a strongly designated verifier, which can limit the scope of signature verification and support simulated signatures to protect privacy; the invention patent with application number CN202110820317.X proposes a traceable attribute-based sanitizable signature scheme, which supports the tracking of malicious signers while achieving message sanitization; the invention patent with application number CN202210378519.8 proposes a forward-secure and efficient attribute-based sanitizable signature scheme, which achieves forward security through time-segment key updates. The above solutions all revolve around attribute-based clean signatures, expanding functionality in areas such as auxiliary verification, specified verification, identity tracking, and forward security. However, they share common limitations: high computational costs, and the extensive use of complex pairing operations makes them difficult to deploy in environments with limited computing resources, such as mobile devices or industrial sensors. Furthermore, these solutions are still based on public key infrastructure or identity cryptography, failing to completely eliminate the security risks associated with cumbersome certificate management or key escrow. Summary of the Invention

[0005] To address the problems of insufficient privacy protection, complex key management, poor flexibility, and high computational cost in existing technologies, this application proposes a certificateless, de-identified signature method and system for specifying a verifier.

[0006] In a first aspect, the present invention provides a certificate-free, de-identified signature method for specifying a verifier, comprising: The key generation center generates the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and publishes the globally public parameters. The anonymizer generates a first complete public-private key pair based on the globally public parameters and a first secret value selected by themselves; the designated verifier generates a second complete public-private key pair based on the globally public parameters and a second secret value selected by themselves. The key generation center generates a partial private key for the signer, and the signer generates a third complete public-private key pair based on the partial private key; The signer signs the message to be signed and embeds the identity information of the designated verifier into the signature to generate the original directed signature; The desensitizer performs desensitization calculations on the sensitive information in the original targeted signature according to the preset desensitization strategy, generates a desensitized signature, and sends it to the designated verifier. The designated verifier uses the private key information from the second complete public-private key pair and the public key information from the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer, and outputs the verification result.

[0007] The key generation center generates a master private key and a master public key based on a cyclic group, generators, and multiple one-way cryptographic hash functions, and publishes globally public parameters, including: Create prime numbers of order respectively addition cyclic group and prime numbers Multiplication cyclic group ; In addition cyclic group Randomly select elements As an addition cyclic group The generators, according to the normal cyclic group and multiplication cyclic group Define a bilinear mapping; Choose four cryptographic hash functions; The key generation center randomly selects the first random number. As the master key, based on the master key and generators Calculate the public key ;in, For model The cyclic multiplication group consisting of non-zero residue classes; According to prime numbers Addition Cyclic Group Generator Public Key First cryptographic hash function Second cryptographic hash function Third cryptographic hash function and the fourth cryptographic hash function Publish globally public parameters ; in, These are globally public parameters.

[0008] The anonymizer generates a first complete public-private key pair based on the globally public parameters and a self-selected first secret value; the designated verifier generates a second complete public-private key pair based on the globally public parameters and a self-selected second secret value, including: Desensitized individuals in cyclic multiplication groups The first secret value is randomly selected. Based on the generators in the globally public parameters and the first secret value Generate the first complete private key and the first complete public key The first complete private key and the first complete public key together form the first complete public-private key pair; Designated verifier in cyclic multiplication group Randomly select the second secret value Based on the generators in the globally public parameters And the second secret value Generate a second complete private key and the second complete public key The second complete private key and the second complete public key together form the second complete public-private key pair.

[0009] The key generation center generates a partial private key for the signer, and the signer uses this partial private key to generate a third complete public-private key pair, including: Based on the globally public parameters, the master key, and the signer's identity. The key generation center calculates a portion of the signer's private key. ,in, The hash value of the first cryptographic hash function. , Master key This is a portion of the signer's private key. The first cryptographic hash function for globally public parameters; The signer randomly selects a third secret value. ; According to the third secret value Elements in globally public parameters and part of the signer's private key Calculate the public key value Then the signer's public key is The signer's private key is The signer's public key and private key are combined to form a third complete public-private key pair.

[0010] The signer signs the message to be signed and embeds the identity information of the designated verifier into the signature to generate an original directed signature, including: The message awaiting signature Divided into piece; For any message block In the cyclic multiplication group Select the second random number ; Based on the second random number and generators in globally public parameters Calculate the second part of the signature Set the set of indexes that need to be de-identified as follows: ; According to the second part of the signature The identity of the signatory The signer's public key The signer's private key And globally public parameters, calculate hash values, including: second hash value Third hash value Fourth hash value ; when At that time, based on the second hash value Third hash value Fourth hash value The second part of the signature and part of the signer's private key Calculate the first part of the signature ; when At that time, based on the second hash value Third hash value Fourth hash value First complete public key The third secret value and part of the signer's private key Calculate the first part of the signature ; Based on the second part of the signature and the third secret value Generate the i-th de-identified authorization token. , ; The original directed signature is obtained from the first part of the signature and the second part of the signature. ; Based on the i-th de-identification authorization token, obtain the total de-identification authorization tokens. .

[0011] The de-identifier performs de-identification calculations on the sensitive information in the original targeted signature according to a preset de-identification strategy, generates a de-identified signature, and sends it to the designated verifier, including: According to the message to be signed Generate new messages Only sets News ; According to the message to be signed New news The first part of the signature The i-th de-identified authorization token First Secret Value and the third hash value Calculate the first part of the anonymized signature. ,in ; According to the first part of the desensitized signature Second complete public key And bilinear mapping, calculating and verifying authorization tokens. ;in, It is a bilinear mapping; According to the first part of the desensitized signature And the second part of the signature The generated de-identified signature is ,in .

[0012] The designated verifier uses the private key information from the second complete public-private key pair and the public key information from the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer, and outputs the verification result, including: Specify the validator using a public parameter set The identity of the signatory The message to be signed and the de-identified message signature pair The signer's public key Specify the verifier's private key Verify authorization token For input; Based on the verification authorization token The hash value of the first cryptographic hash function Second hash value Third hash value Fourth hash value The second part of the signature The signer's public key Second secret value and public key Construct an equation and verify whether it is true. The expression of the equation is as follows: ; in, It is a bilinear mapping. Message awaiting signature M Any message block in n Message awaiting signature M The number of blocks, i Message awaiting signature M The i piece; If true, it means the anonymized signature was generated by the signer, and the output is "accept"; if false, it means the anonymized signature was not generated by the signer, and the output is "reject".

[0013] Secondly, the present invention also provides a certificateless desensitized signature system for a designated verifier, implemented using a certificateless desensitized signature method for a designated verifier as described in the first aspect, comprising: The initialization module is used by the key generation center to generate the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and to publish the globally public parameters. The public-private key pair generation module is used by the anonymizer to generate a first complete public-private key pair based on the globally public parameters and a first secret value selected by the anonymizer; the designated verifier generates a second complete public-private key pair based on the globally public parameters and a second secret value selected by the anonymizer; the key generation center generates a partial private key for the signer, and the signer generates a third complete public-private key pair based on the partial private key. The signature generation module is used by the signer to sign the message to be signed and to embed the identity information of the specified verifier into the signature to generate the original directed signature. The desensitization calculation module is used by the desensitizer to perform desensitization calculations on the sensitive information in the original targeted signature according to the preset desensitization strategy, generate a desensitized signature, and send it to the designated verifier. The signature verification module is used by the specified verifier to use the private key information in the second complete public-private key pair and the public key information in the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer and output the verification result.

[0014] Thirdly, this application proposes an electronic device, comprising: one or more processors, and a memory for storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the certificateless desensitized signature method for a specified verifier.

[0015] Fourthly, this application proposes a computer-readable storage medium storing executable instructions that, when executed, cause a processor to perform the aforementioned certificate-free desensitized signature method for a designated verifier.

[0016] Beneficial effects: This application proposes a certificate-free, de-identified signature method and system for specifying a verifier, with the following advantages: (1) Addressing the issues of certificate-free management and key escrow, thus enhancing the security of the key system: This invention introduces a core design of a certificate-free cryptosystem. The signer's private key is composed of a partial private key provided by the Key Generation Center (KGC) and a secret value selected by the signer. The anonymized party and designated verifier can also generate complete public-private key pairs themselves. This overcomes the complex certificate application, storage, update, and verification management overhead of traditional public-key cryptosystems, and avoids the security risks such as leakage and abuse caused by the complete escrow of keys by authoritative institutions in identity-based cryptosystems, thus constructing a more secure key management system.

[0017] (2) Implement targeted signature verification to prevent unauthorized abuse and privacy leaks: By incorporating a designated verifier mechanism, signature validity verification permissions are specifically bound to a designated verification entity. The identity information of the designated verifier is embedded during the signature generation process. Only this designated verifier can use their private key to verify the legitimacy of the anonymized signature; no other third party can verify the signature's validity. This effectively prevents the signature from being obtained and abused by unauthorized entities, while protecting the signer's identity privacy and the targeted nature of the signature information, making it suitable for privacy protection scenarios requiring targeted authentication, such as government, military, and medical fields.

[0018] (3) Supports dynamic desensitization of sensitive information, balancing data privacy and signature validity: A flexible desensitization mechanism is designed, allowing semi-trusted desensitizers to dynamically modify and desensitize sensitive message blocks in the original signature within a preset desensitization authorization scope, and generate a valid desensitized signature. This not only achieves privacy protection for sensitive information during data flow and solves the problem that existing solutions cannot dynamically desensitize signed messages, but also maintains the integrity and non-repudiation of the desensitized signature, ensuring that the desensitized signature can still be effectively verified by a designated verifier.

[0019] (4) High computational efficiency and adaptability to resource-constrained devices and practical applications in multiple fields: This invention avoids the numerous complex pairing operations found in existing attribute-based desensitized signature schemes. The computational steps of the overall signature, desensitization, and verification process are simple and efficient, reducing computational resource consumption. It can not only run efficiently on ordinary servers and terminal devices, but also adapt to devices with limited computing resources such as mobile terminals and industrial sensors. At the same time, it can meet the dual needs of digital signatures and data privacy protection in multiple fields such as government documents, medical diagnosis, and financial transactions, making it widely adaptable to various scenarios.

[0020] (5) Controllable desensitization authorization enhances the flexibility of signature and data processing: This invention sets up a desensitization authorization token and a desensitization index set, allowing only sensitive message blocks within the authorized scope to be desensitized, thus achieving refined and controllable management of desensitization operations. Compared to existing single-function digital signature schemes, this invention, while ensuring the core functions of signature, endows signed messages with flexible desensitization processing capabilities, adapting to the diverse needs of data hierarchical use and on-demand hiding of sensitive information in practical applications, thereby improving the system's practicality and flexibility. Attached Figure Description

[0021] Figure 1 Flowchart of a certificate-free, de-identified signature method for specifying a verifier according to an embodiment of the present invention; Figure 2 A schematic flowchart of a certificate-free, de-identified signature method for specifying a verifier according to an embodiment of the present invention; Figure 3 A block diagram illustrating the principle of a certificate-free, de-identified signature system for designating a verifier, according to an embodiment of the present invention. Detailed Implementation

[0022] The specific implementation methods of this application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0023] This application introduces the core concept of certificateless cryptography, where the signer's private key is composed of a portion of the private key provided by the key generation center and a secret value chosen by the signer. This overcomes the high certificate management overhead of traditional public-key cryptography and avoids the security risks of key escrow in identity-based cryptography. By incorporating a designated verifier mechanism, signature validity verification permissions are directly bound to a specific verification entity, allowing only designated verifiers to perform signature legitimacy verification. This effectively prevents signatures from being misused by unauthorized third parties and protects the signer's identity privacy. A flexible de-identification mechanism is designed, allowing semi-trusted de-identifiers to dynamically modify sensitive information within a preset authorization scope and generate new valid signatures. This ensures privacy and security during data flow while maintaining the integrity and non-repudiation of the signature. This method eliminates the need for complex certificate management, resists key escrow risks, is computationally efficient, and adaptable to a wide range of scenarios, meeting the dual needs of data privacy protection and targeted signature verification in government, healthcare, and finance sectors.

[0024] Example 1: Firstly, the present invention provides a certificate-free, de-identified signature method for specifying a verifier, such as... Figure 1 , Figure 2 As shown, it includes: Step S1: The key generation center generates the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and publishes the globally public parameters. In this embodiment, the entities involved are as follows: Key Generation Center: Responsible for initializing the system; calculating a portion of the signer's key and sending it to the signer.

[0025] The signer is responsible for signing the file and sending the file, signature, de-identified index set, and authorization token to the internal storage server for storage.

[0026] The desensitizer is responsible for desensitizing sensitive information in the file, generating a new valid signature and verification authorization token, and sending it to the data user.

[0027] Designated verifier: Responsible for verifying the validity of the original or de-identified message signature pair.

[0028] Data users: Users of files and signatures can submit data requests to the anonymizer and send the files, signatures, and verification authorization tokens to the designated verifier for validity verification.

[0029] Internal storage server: responsible for storing all original files, signatures, de-identified index sets, and authorization tokens.

[0030] The key generation center generates a master private key and a master public key based on a cyclic group, generators, and multiple one-way cryptographic hash functions, and publishes globally public parameters, including: Step S1.1: Create prime numbers of order respectively addition cyclic group and prime numbers Multiplication cyclic group ; Step S1.2: In the addition loop group Randomly select elements As an addition cyclic group The generators, according to the normal cyclic group and multiplication cyclic group Define a bilinear mapping; Step S1.3: Select four cryptographic hash functions H 1:{0,1} * → G , H 2:{0,1} * × G → , H 3:{0,1} * × G → and H 4:{0,1} * × G × G → G ; Let closure be a set of binary strings of arbitrary finite length consisting of 0s and 1s, where For model The cyclic multiplication group consisting of non-zero residue classes; Step S1.4: The key generation center randomly selects the first random number. As the master key, based on the master key and generators Calculate the public key ; Because pairing operations in existing technologies are computationally expensive, this embodiment replaces pairing with elliptic curve scalar dot product. The generator P is a point taken from the elliptic curve, and the public key is generated using elliptic curve scalar dot product.

[0031] Step S1.5: Based on prime numbers Addition Cyclic Group Generator Public Key First cryptographic hash function Second cryptographic hash function Third cryptographic hash function and the fourth cryptographic hash function Publish globally public parameters ; in, These are globally public parameters.

[0032] Step S2: The anonymizer generates a first complete public-private key pair based on the globally public parameters and a self-selected first secret value; the designated verifier generates a second complete public-private key pair based on the globally public parameters and a self-selected second secret value, including: Step S2.1: Desensitized individuals in cyclic multiplication groups The first secret value is randomly selected. Based on the generators in the globally public parameters and the first secret value Generate the first complete private key and the first complete public key The first complete private key and the first complete public key together form the first complete public-private key pair; Step S2.2: Assign a verifier to the cyclic multiplication group Randomly select the second secret value Based on the elements in the globally public parameters And the second secret value Generate a second complete private key and the second complete public key The second complete private key and the second complete public key together form the second complete public-private key pair.

[0033] Step S3: The key generation center generates a partial private key for the signer. Based on this partial private key, the signer generates a third complete public-private key pair, including: Step S3.1: Based on the globally public parameters, the master key, and the signer's identity. The key generation center calculates a portion of the signer's private key. ,in, The hash value of the first cryptographic hash function. , Master key This is a portion of the signer's private key. The first cryptographic hash function for globally public parameters; Step S3.2: The signer randomly selects a third secret value. ; Step S3.4: Based on the third secret value Elements in globally public parameters and part of the signer's private key Calculate the public key value Then the signer's public key is The signer's private key is The signer's public key and private key are combined to form a third complete public-private key pair.

[0034] Step S4: The signer signs the message to be signed and embeds the identity information of the designated verifier into the signature to generate the original directed signature, including: Step S4.1: Send the message to be signed Divided into piece; Step S4.2: For any message block In the cyclic multiplication group Select the second random number ; Step S4.3: Based on the second random number and generators in globally public parameters Calculate the second part of the signature Set the set of indexes that need to be de-identified as follows: ; Step S4.4: Based on the second part of the signature The identity of the signatory The signer's public key The signer's private key And globally public parameters, calculate hash values, including: second hash value Third hash value Fourth hash value ; Step S4.5: When At that time, based on the second hash value Third hash value Fourth hash value The second part of the signature and part of the signer's private key Calculate the first part of the signature ; Step S4.6: When At that time, based on the second hash value Third hash value Fourth hash value First complete public key The third secret value and part of the signer's private key Calculate the first part of the signature ; Step S4.7: Based on the second part of the signature and the third secret value Generate the i-th de-identified authorization token. , ; Step S4.8: Obtain the original directed signature based on the first part and the second part of the signature. ; Step S4.9: Obtain the total number of de-identification authorization tokens based on the i-th de-identification authorization token. .

[0035] Step S5: The de-identifier performs de-identification calculations on the sensitive information in the original targeted signature according to the preset de-identification strategy, generates a de-identified signature, and sends it to the designated verifier, including: Step S5.1: Based on the message to be signed Generate new messages Only sets News This indicates that the message will change when i is in K, and will remain unchanged when i is not in K. Step S5.2: Based on the message to be signed New news The first part of the signature The i-th de-identified authorization token First Secret Value and the third hash value Calculate the first part of the anonymized signature. ,in ; Step S5.3: Based on the first part of the desensitized signature Second complete public key And bilinear mapping, calculating and verifying authorization tokens. ;in, It is a bilinear mapping; Step S5.4: Based on the first part of the desensitized signature And the second part of the signature The generated de-identified signature is ,in .

[0036] Step S6: The designated verifier uses the private key information from the second complete public-private key pair and the public key information from the signer's third complete public-private key pair to determine whether the anonymized signature was generated by the signer, and outputs the verification result, including: Step S6.1: Specify the validator using the public parameter set The identity of the signatory The message to be signed and the de-identified message signature pair The signer's public key Specify the verifier's private key Verify authorization token For input; Step S6.2: Verify the authorization token The hash value of the first cryptographic hash function Second hash value Third hash value Fourth hash value The second part of the signature The signer's public key Second secret value and public key Construct an equation and verify whether it is true. The expression of the equation is as follows: ; in, It is a bilinear mapping. Message awaiting signature M Any message block in n Message awaiting signature M The number of blocks, i Message awaiting signature M The i piece; Step S6.3: If true, it means that the de-identified signature was generated by the signer, and the output is "Accept"; if false, it means that the de-identified signature was not generated by the signer, and the output is "Reject".

[0037] This embodiment proposes a certificate-free, de-identified signature method for a designated verifier, including: key generation center initialization, key generation for the de-identifier and the designated verifier, key generation for the signer, and generation of the original directed signature. The de-identifier performs de-identification calculations on sensitive information in the original directed signature according to a preset de-identification strategy to generate a de-identified signature. The designated verifier uses its private key information and the signer's public key information to determine whether the de-identified signature was generated by the signer and outputs the verification result. The original signature is generated for the original message; after the de-identifier de-identifies the message, the original signature is invalid for new messages after de-identification. Traditional methods require the original signer to re-sign, but in this embodiment, the de-identifier uses a de-identification authorization token to independently complete this conversion without the original signer's participation. The designated verifier uses its own private key information in conjunction with the signer's public key information to complete the verification. The core innovation of this verification mechanism is that the verifier must possess two "keys" simultaneously—its own private key and the signer's public key—to complete the verification. Even if any third party obtains the signer's public key, it cannot verify the validity of the signature due to the lack of the designated verifier's private key. This fundamentally prevents the malicious dissemination and illegal misuse of anonymized signatures. After the anonymized party de-identifies the message, how can a valid signature be generated for the new anonymized message, created by the original signer and still verifiable only by the originally designated verifier, without the original signer's involvement, and how can this designated verifier efficiently and reliably verify the anonymized signature? This three-party cryptographic protocol of "signer designation—anonymized party execution—designated verifier verification" achieves a balance between anonymization and targeted verification in a certificate-free system.

[0038] Example 2: This embodiment provides a certificate-free, de-identified signature system for a designated verifier, implemented using a certificate-free, de-identified signature method for a designated verifier as described in Embodiment 1. Figure 3 As shown, it includes: an initialization module, a public-private key pair generation module, a signature generation module, a de-identification calculation module, and a signature verification module, wherein the initialization module, the public-private key pair generation module, the signature generation module, the de-identification calculation module, and the signature verification module are connected in sequence. The initialization module is used by the key generation center to generate the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and to publish the globally public parameters. The public-private key pair generation module is used by the anonymizer to generate a first complete public-private key pair based on the globally public parameters and a first secret value selected by the anonymizer; the designated verifier generates a second complete public-private key pair based on the globally public parameters and a second secret value selected by the anonymizer; the key generation center generates a partial private key for the signer, and the signer generates a third complete public-private key pair based on the partial private key. The signature generation module is used by the signer to sign the message to be signed and to embed the identity information of the specified verifier into the signature to generate the original directed signature. The desensitization calculation module is used by the desensitizer to perform desensitization calculations on the sensitive information in the original targeted signature according to the preset desensitization strategy, generate a desensitized signature, and send it to the designated verifier. The signature verification module is used by the specified verifier to use the private key information in the second complete public-private key pair and the public key information in the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer and output the verification result.

[0039] Example 4: This embodiment proposes an electronic device, including: one or more processors, and a memory, the memory being used to store instructions, which, when executed by the one or more processors, cause the one or more processors to execute the certificateless desensitized signature method for specifying a verifier.

[0040] The electronic device may be a mobile phone, computer, or tablet computer, etc., and includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements a certificate-free, de-identified signature method for specifying a verifier as described in the embodiments. It is understood that the electronic device may also include input / output (I / O) interfaces and communication components.

[0041] The processor is used to execute all or part of the steps in the certificate-free, de-identified signature method for specifying a verifier as described in the above embodiments. The memory is used to store various types of data, which may include, for example, instructions for any application or method in the electronic device, as well as application-related data.

[0042] The processor may be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor, or other electronic components, and is used to execute the certificate-free de-identified signature method for specifying a verifier as described in the above embodiments.

[0043] Example 5: This embodiment proposes a computer-readable storage medium that stores executable instructions. When these instructions are executed, if they are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0044] The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of a certificateless desensitized signature method for a designated verifier as described in various embodiments of this application.

[0045] The aforementioned storage media include: flash memory, hard disks, multimedia cards, card-type memory (e.g., SD (Secure Digital Memory Card) or DX (Memory Data Register, MDR) memory), random access memory (RAM), static random-access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, disks, optical discs, servers, APP (Application) application stores, and other media capable of storing program verification codes. These media store computer programs, and when executed by a processor, they can implement the various steps of the aforementioned certificate-free, de-identified signature method for specifying a verifier.

[0046] Example 6: This embodiment proposes a computer program product, including a computer program or instructions, which, when executed by a processor, implements the aforementioned certificate-free desensitized signature method for a designated verifier.

[0047] Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a computer program product.

[0048] The various embodiments in this application are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0049] The scope of protection of this application is not limited to the embodiments described above. Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from the scope and spirit of this disclosure. If such modifications and variations fall within the scope of equivalent technology of this disclosure, then the intent of this disclosure also includes such modifications and variations.

Claims

1. A certificate-free, de-identified signature method for specifying a verifier, characterized in that, include: The key generation center generates the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and publishes the globally public parameters. The anonymized user generates the first complete public-private key pair based on the globally public parameters and the first secret value they choose. The designated verifier generates a second complete public-private key pair based on the globally public parameters and a second secret value selected by the verifier. The key generation center generates a partial private key for the signer, and the signer generates a third complete public-private key pair based on the partial private key; The signer signs the message to be signed and embeds the identity information of the designated verifier into the signature to generate the original directed signature; The desensitizer performs desensitization calculations on the sensitive information in the original targeted signature according to the preset desensitization strategy, generates a desensitized signature, and sends it to the designated verifier. The designated verifier uses the private key information from the second complete public-private key pair and the public key information from the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer, and outputs the verification result.

2. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The key generation center generates a master private key and a master public key based on a cyclic group, generators, and multiple one-way cryptographic hash functions, and publishes globally public parameters, including: Create prime numbers of order respectively addition cyclic group and prime numbers Multiplication cyclic group ; In addition cyclic group Randomly select elements As an addition cyclic group The generators, according to the normal cyclic group and multiplication cyclic group Define a bilinear mapping; Choose four cryptographic hash functions; The key generation center randomly selects the first random number. As the master key, based on the master key and generators Calculate the public key ;in, For model The cyclic multiplication group consisting of non-zero residue classes; According to prime numbers Addition Cyclic Group Generator Public Key First cryptographic hash function Second cryptographic hash function Third cryptographic hash function and the fourth cryptographic hash function Publish globally public parameters ; in, These are globally public parameters.

3. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The anonymizer generates a first complete public-private key pair based on the globally public parameters and the first secret value selected by themselves; The designated verifier generates a second complete public-private key pair based on the globally public parameters and a self-selected second secret value, including: Desensitized individuals in cyclic multiplication groups The first secret value is randomly selected. Based on the generators in the globally public parameters and the first secret value Generate the first complete private key and the first complete public key The first complete private key and the first complete public key together form the first complete public-private key pair; Designated verifier in cyclic multiplication group Randomly select the second secret value Based on the generators in the globally public parameters And the second secret value Generate a second complete private key and the second complete public key The second complete private key and the second complete public key together form the second complete public-private key pair.

4. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The key generation center generates a partial private key for the signer, and the signer uses this partial private key to generate a third complete public-private key pair, including: Based on the globally public parameters, the master key, and the signer's identity. The key generation center calculates a portion of the signer's private key. ,in, The hash value of the first cryptographic hash function. , Master key This is a portion of the signer's private key. The first cryptographic hash function for globally public parameters; The signer randomly selects a third secret value. ; According to the third secret value Elements in globally public parameters and part of the signer's private key Calculate the public key value Then the signer's public key is The signer's private key is The signer's public key and private key are combined to form a third complete public-private key pair.

5. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The signer signs the message to be signed and embeds the identity information of the designated verifier into the signature to generate an original directed signature, including: The message awaiting signature Divided into piece; For any message block In the cyclic multiplication group Select the second random number ; Based on the second random number and generators in globally public parameters Calculate the second part of the signature Set the set of indexes that need to be de-identified as follows: ; According to the second part of the signature The identity of the signatory The signer's public key The signer's private key And globally public parameters, calculate hash values, including: second hash value Third hash value Fourth hash value ; when At that time, based on the second hash value Third hash value Fourth hash value The second part of the signature and part of the signer's private key Calculate the first part of the signature ; when At that time, based on the second hash value Third hash value Fourth hash value First complete public key The third secret value and part of the signer's private key Calculate the first part of the signature ; Based on the second part of the signature and the third secret value Generate the i-th de-identified authorization token. , ; The original directed signature is obtained from the first part of the signature and the second part of the signature. ; Based on the i-th de-identification authorization token, obtain the total de-identification authorization tokens. .

6. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The de-identifier performs de-identification calculations on the sensitive information in the original targeted signature according to a preset de-identification strategy, generates a de-identified signature, and sends it to the designated verifier, including: According to the message to be signed Generate new messages Only sets News ; According to the message to be signed New news The first part of the signature The i-th de-identified authorization token First Secret Value and the third hash value Calculate the first part of the anonymized signature. ,in ; According to the first part of the desensitized signature Second complete public key And bilinear mapping, calculating and verifying authorization tokens. ;in, It is a bilinear mapping; According to the first part of the desensitized signature And the second part of the signature The generated de-identified signature is ,in .

7. The certificate-free, de-identified signature method for specifying a verifier according to claim 1, characterized in that, The designated verifier uses the private key information from the second complete public-private key pair and the public key information from the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer, and outputs the verification result, including: Specify the validator using a public parameter set The identity of the signatory The message to be signed and the de-identified message signature pair The signer's public key Specify the verifier's private key Verify authorization token For input; Based on the verification authorization token The hash value of the first cryptographic hash function Second hash value Third hash value Fourth hash value The second part of the signature The signer's public key Second secret value and public key Construct an equation and verify whether it is true. The expression of the equation is as follows: ； in, It is a bilinear mapping. Message awaiting signature M Any message block in n Message awaiting signature M The number of blocks, i Message awaiting signature M The i piece; If true, it means the anonymized signature was generated by the signer, and the output is "accept"; if false, it means the anonymized signature was not generated by the signer, and the output is "reject".

8. A certificate-free, de-identified signature system for a designated verifier, implemented using the certificate-free, de-identified signature method for a designated verifier as described in any one of claims 1 to 7, comprising: The initialization module is used by the key generation center to generate the master private key and master public key based on the cyclic group, generator, and multiple one-way cryptographic hash functions, and to publish the globally public parameters. The public-private key pair generation module is used by the anonymizer to generate the first complete public-private key pair based on the globally public parameters and the first secret value selected by themselves. The designated verifier generates a second complete public-private key pair based on the globally public parameters and a second secret value selected by the verifier. The key generation center generates a partial private key for the signer, and the signer generates a third complete public-private key pair based on the partial private key; The signature generation module is used by the signer to sign the message to be signed and to embed the identity information of the specified verifier into the signature to generate the original directed signature. The desensitization calculation module is used by the desensitizer to perform desensitization calculations on the sensitive information in the original targeted signature according to the preset desensitization strategy, generate a desensitized signature, and send it to the designated verifier. The signature verification module is used by the specified verifier to use the private key information in the second complete public-private key pair and the public key information in the signer's third complete public-private key pair to determine whether the de-identified signature was generated by the signer and output the verification result.

9. An electronic device, characterized in that, include: One or more processors, and a memory for storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a certificate-free, de-identified signature method for a specified verifier as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores executable instructions that, when executed, cause the processor to perform a certificateless desensitized signature method for a specified verifier as described in any one of claims 1 to 7.

Images