Signature generation method and apparatus, and device, storage medium and program product

Abstract

The present application belongs to the technical field of cryptography. Disclosed are a signature generation method and apparatus, and a device, a storage medium and a program product. The method comprises: acquiring first signature data from among a plurality of pieces of signature data, wherein the first signature data comprises a first count value and a first signature parameter, the first signature parameter is determined on the basis of a first signature random number, and the first signature random number is determined on the basis of the first count value; and on the basis of the first signature data, generating a signature of target data by means of a target signature algorithm. In the present application, when target data is signed, first signature data is directly retrieved from among a plurality of pieces of signature data and used, and there is no need to calculate the first signature data in real time, thereby improving signature efficiency. Since the signature data comprises a count value for determining a signature random number, rather than the signature random number itself, there is no need to securely store the count value, and a signature process is not limited by the resource bottleneck of secure hardware that stores the signature random number.

Description

Signature generation method, device, equipment, storage medium and program product

[0001] The present application claims priority to the Chinese patent application No. 202411295760.X, filed on September 14, 2024, and entitled "Signature generation method, device, equipment, storage medium and program product", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the technical field of cryptography, in particular to a signature generation method, device, equipment, storage medium and program product. BACKGROUND

[0003] In the cloud service scenario, especially during peak periods such as e-commerce promotion, social media activities, real-time communication applications, the cloud server needs to handle requests from thousands or even millions of users at the same time, and these requests may include user login, data exchange, payment transactions, etc., and each request needs to go through identity verification and key agreement to ensure the security of communication and the integrity of data, and this process often requires the cloud server to perform a large number of digital signature operations. Among them, digital signature is to use private key, random number and other information to sign the hash value of the data, and the receiver uses the corresponding public key to verify, so as to ensure the integrity of the data and the authenticity of the source. In order to protect the private key and random number used in signing from being illegally obtained, the private key and random number used in signing usually need to be securely stored in the security hardware of the cloud server.

[0004] However, the resources (such as processing power, memory, bandwidth, etc.) of the security hardware are limited, when the cloud server needs to perform digital signature operations on a large number of user requests in a short time, the security hardware may become a performance bottleneck, causing delays in digital signature operations, and even some requests may timeout due to waiting for security hardware resources. SUMMARY

[0005] The present application provides a signature generation method, device, equipment, storage medium and program product, the signature data of the present application includes a count value for determining a signature random number, rather than the signature random number itself, so there is no need to securely store the count value; and the signature data can be directly used in the signature process, without the need to calculate the signature data in real time, improving the efficiency of online signature. The technical solution is as follows:

[0006] In a first aspect, a signature generation method is provided, the method comprising:

[0007] obtaining first signature data from a plurality of signature data, the first signature data comprising a first count value and a first signature parameter, the first signature parameter being determined based on a first signature random number, and the first signature random number being determined based on the first count value; generating a signature of target data by a target signature algorithm based on the first signature data.

[0008] In a possible implementation, the target signature algorithm is a signature algorithm that uses the first signature random number for signature.

[0009] Therefore, when signing the target data, the application can directly call the first signature data from the plurality of signature data, without the need to calculate and generate the first signature data in real time, thereby improving the efficiency of online signature. Moreover, for each signature data in the plurality of signature data, since the signature data comprises a count value for determining a signature random number instead of the signature random number itself, even if the count value is stolen, it is difficult to derive the corresponding signature random number, and therefore, the count value does not need to be stored securely, and the signature process is not limited by the resource bottleneck of the secure hardware for storing the signature random number.

[0010] In a possible implementation, before the obtaining the first signature data from the plurality of signature data, the method further comprises:

[0011] for each count value in the plurality of count values, generating a signature random number based on a random number generation function and the count value, generating a signature parameter based on the signature random number, and constructing and storing the plurality of signature data, each signature data comprising a count value and a signature parameter corresponding to the count value.

[0012] Therefore, the application can construct and store a plurality of signature data in advance, each signature data comprising a corresponding signature parameter. In this way, when signing the data, a signature data can be directly called, and the signature parameter in the signature data can be used for signature, thereby reducing the data calculation amount in the online calculation stage and improving the efficiency of online signature.

[0013] In a possible implementation, the random number generation function is a pseudo-random number generation function; and the generating the signature random number based on the random number generation function and the count value comprises:

[0014] inputting the count value and a seed value as inputs of the pseudo-random number generation function, and generating the signature random number by the pseudo-random number generation function, the seed value being used to derive the signature random number.

[0015] In a possible implementation, the seed value comprises a signature key of a signature device.

[0016] The signature key can be a private key of the signature device, or can be another key used to generate a digital signature, and the application does not limit the signature random number. The signature random number can be a random number directly used when calculating a signature parameter, or can be an inverse element of the random number, that is, an inverse element of a random number output by a random number generation function when calculating a signature parameter. The application does not limit the signature random number.

[0017] In a possible implementation, the first signature data is one of the plurality of signature data, and the first signature data is not used to generate a signature by the target signature algorithm before the target data is signed.

[0018] Since the first signature parameter in the first signature data is determined based on the first signature random number, to avoid the case that the generated first signature parameter is the same in the case that the random number is the same, the application needs to select one signature data that is not used to generate a signature from the plurality of signature data as the first signature data when obtaining the first signature data.

[0019] In a possible implementation, the target signature algorithm is an elliptic curve digital signature algorithm (ECDSA) based on elliptic curve cryptography, and elliptic curve parameters corresponding to the ECDSA include coordinates of a base point on an elliptic curve and an order of the base point.

[0020] In a possible implementation, the signature random number includes a first random number, and the generating a signature parameter based on the signature random number includes:

[0021] The first random number is multiplied by the coordinates of the base point to obtain the signature parameter, and the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter includes x coordinates and y coordinates of the target point.

[0022] Since the random number generation function can directly generate the inverse element of the signature random number based on the count value, it means that the inverse element of the signature random number calculated by the random number generation function in the pre-computation stage. Since the calculation process of the inverse element of the signature random number can be completed in the pre-computation stage, and the calculation of the inverse element of the signature random number itself is also a time-consuming operation in the signature process, the calculation of the inverse element of the signature random number and the signature parameter in the pre-computation stage is equivalent to pushing all time-consuming calculations in ECDSA to the pre-computation stage, which can greatly improve the efficiency of subsequent online signature.

[0023] In a possible implementation, the signature random number comprises an inverse of the first random number; and the generating the signature parameter based on the signature random number comprises:

[0024] determining the first random number based on the signature random number; and multiplying the first random number by the coordinate of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter comprises an x-coordinate and a y-coordinate of the target point.

[0025] As can be seen, when the signature random number is generated based on the random number generation function, the first random number required for calculating the signature parameter can be directly generated, or the inverse of the first random number can be generated, which is not limited in the present application.

[0026] In a possible implementation, the target signature algorithm is ECDSA; and the generating the signature of the target data based on the first signature data by using the target signature algorithm comprises:

[0027] generating the first signature random number based on the first count value by using the random number generation function; determining the inverse of the first signature random number; and generating the signature of the target data based on the inverse of the first signature random number and the first signature parameter by using the target signature algorithm.

[0028] That is, for the ECDSA, when the first signature random number is generated by using the random number generation function, the inverse of the first signature random number needs to be calculated based on the first signature random number by using the inverse operation, and then the inverse of the first signature random number and the first signature parameter are used to generate the signature.

[0029] In a possible implementation, the target signature algorithm is ECDSA; and the generating the signature of the target data based on the first signature data by using the target signature algorithm comprises:

[0030] generating the inverse of the first signature random number based on the first count value by using the random number generation function; and generating the signature of the target data based on the inverse of the first signature random number and the first signature parameter by using the target signature algorithm.

[0031] Since the inverse of the signature random number is itself a relatively time-consuming operation in the signature process, if the inverse of the first signature random number is directly generated by using the random number generation function, the inverse of the first signature random number can be directly used to generate the signature in the online calculation stage, thereby reducing the data calculation amount in the online calculation stage and improving the efficiency of the online signature.

[0032] In a second aspect, a signature generation apparatus is provided, which has a function of implementing the signature generation method in the first aspect. The signature generation apparatus comprises at least one module for implementing the signature generation method in the first aspect.

[0033] In a third aspect, a computer device is provided, which comprises a processor and a memory for storing a computer program for implementing the signature generation method in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the signature generation method in the first aspect.

[0034] In a possible implementation, the computer device can further comprise a communication bus for establishing a connection between the processor and the memory.

[0035] In a fourth aspect, a computer readable storage medium is provided, which stores instructions for causing a computer to perform the steps of the signature generation method in the first aspect when the instructions are run on the computer.

[0036] In a fifth aspect, a computer program product is provided, which comprises instructions for causing a computer to perform the steps of the signature generation method in the first aspect when the instructions are run on the computer. Alternatively, a computer program is provided, which causes a computer to perform the steps of the signature generation method in the first aspect when the computer program is run on the computer.

[0037] The technical effects obtained by the second aspect, the third aspect, the fourth aspect and the fifth aspect are similar to those obtained by the corresponding technical means in the first aspect, which will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0038] FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0039] FIG. 2 is a structural schematic diagram of a computer device provided by an embodiment of the present application;

[0040] FIG. 3 is a flow schematic diagram of a signature generation method provided by an embodiment of the present application;

[0041] FIG. 4 is a structural schematic diagram of a signature generation apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0042] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0043] For ease of understanding, before the signature generation method provided by the embodiments of the present application is explained and described, the terms, application scenarios and implementation environments related to the embodiments of the present application are introduced.

[0044] Firstly, the terms related to the embodiments of the present application are introduced.

[0045] Online computation: computation that must be performed immediately / in real time.

[0046] Pre-computation: computation that can be performed in advance relative to online computation, and the computation result is used for online computation.

[0047] As an example, since the computation of data A needs to use data B and data C, and the computation process of data B and data C does not involve the parameters used when data A is computed, data B and data C can be computed in the pre-computation stage and stored. When data A is computed online, the pre-computed data B and data C are called to perform the relevant computation operation, so as to quickly and effectively compute data A.

[0048] Secondly, the application scenarios of the embodiments of the present application are introduced.

[0049] Referring to FIG. 1, in a cloud service scenario, especially during peak periods such as e-commerce promotion, social media activities, real-time communication applications, etc., the cloud server 100 needs to handle requests from thousands or even millions of user devices 200 at the same time. These requests may include user login, data exchange, payment transactions, etc., and each request needs to go through identity verification and key negotiation to ensure the security of communication and the integrity of data.

[0050] Digital signature is one of the important means to protect network communication security, which encrypts (i.e., signs) the hash value of data using a private key, and the receiver decrypts and verifies using the corresponding public key, thereby ensuring the integrity of data and the authenticity of the source. In the above cloud service scenario, digital signature is often used for identity authentication, transaction confirmation, etc.

[0051] Since the signature needs to use the private key, in order to protect the private key from being illegally obtained or misused, the signature private key is usually securely stored in the secure hardware 300. These secure hardware can be integrated in the cloud server, or exist independently outside the cloud server. The secure hardware provides a higher level of security protection than software, which can resist physical attacks, software vulnerabilities, etc. The secure hardware 300 can be: hardware security module (HSM), secure enclave processor (SEP), etc.

[0052] Although secure hardware provides strong security guarantees, its resources (e.g., processing power, memory, bandwidth, etc.) are limited. When a cloud server needs to handle a large number of user requests in a short period of time, each of which requires a digital signature operation, the secure hardware can become a performance bottleneck. The reasons can include:

[0053] (1) Processing speed limitation. That is, the signature operation speed of the secure hardware can not be able to keep up with the processing needs of high concurrency requests, even if each signature operation itself is fast, but a large number of requests accumulated together can make the processing capacity of the secure hardware reach the limit.

[0054] (2) Resource contention. In a high concurrency scenario, multiple user requests can simultaneously request the secure hardware to perform signature operations, resulting in resource contention, which increases the delay of signature operations, and even some requests timeout due to waiting for resources.

[0055] (3) Context switching overhead. When processing requests, the cloud server needs to frequently switch contexts between different tasks (e.g., network processing, application logic, secure hardware calls, etc.). In a high concurrency scenario, this switching overhead will significantly increase, further reducing overall processing performance.

[0056] As an example, suppose an e-commerce platform needs to handle millions of user login requests per minute during a promotion. Each login request needs to be authenticated by the cloud server, including using a private key to digitally sign the user's identity information. If the secure hardware of the cloud server can only handle a few thousand signature requests per second, in a high concurrency scenario, a large number of requests will be queued for signature operations, resulting in user login response delays, and even some users cannot successfully log in.

[0057] Regarding the digital signature process in the above cloud service scenario, the elliptic curve digital signature algorithm (ECDSA) is widely used as a signature algorithm, and the cloud server usually uses ECDSA for signature.

[0058] It should be understood that ECDSA, as a variant of digital signature algorithm (DSA), uses elliptic curve cryptography. Moreover, ECDSA has been widely applied in various fields due to its short key length, fast computing speed, high security, etc., such as electronic payment, identity authentication, Internet of Things security, and blockchain technology, etc.

[0059] The working mechanism of the ECDSA is mainly based on a discrete logarithm problem on an elliptic curve, that is, given a base point G on an elliptic curve and another point K, it is difficult to solve an integer k that makes K=kG hold. The ECDSA uses this difficulty to generate a public key and a private key and to sign and verify.

[0060] The ECDSA works on an elliptic curve group G with an order of a prime number q, where g is a generator of G. A public and private key pair of a signer is (y, sk), where sk is a private key of the signer and y is a public key. y=[sk]g), where sk is a private key of the signer and y is a public key, represents an integer multiplication group modulo q, and [sk]g represents a public key y obtained by performing scalar multiplication on a point g on the elliptic curve by a private key sk.

[0061] The ECDSA signature process for data / message m can generally include the following steps:

[0062] Step S11: Select a random number k.

[0063] The signer randomly selects an integer k, where The random number k plays a key role in the signature process but is not disclosed.

[0064] Step S12: Calculate a point R on the elliptic curve.

[0065] The point R=(rx, ry)=[k]g is calculated by using the random number k and the generator g through scalar multiplication. Here, rx and ry are the x-coordinate and y-coordinate of the point R, respectively.

[0066] Step S13: Calculate a signature value s.

[0067] First, a cryptographic hash function h(.) is applied to the data m to obtain a hash value h(m) of m. Then, s=k -1 (h(m)+rx*sk)(mod q) is calculated. Here, k -1 is the multiplicative inverse of k modulo q, that is, an integer satisfying k*k -1 ≡1(mod q).

[0068] Step S14: Output the signature σ.

[0069] Here, the signature σ=(rx, s). That is, σ is composed of two parts, rx is the x-coordinate of the point R, and s is the calculated signature value.

[0070] After the signer signs the data m using the ECDSA, the data m and the signature σ can be sent to the verifier, that is, the receiver of the data. The verification process of the verifier based on the above signature σ can generally include the following steps:

[0071] Step S21: Calculate u1 and u2 using the signature σ and h(m).

[0072] where u1 = s * h(m) mod q is calculated using s in the signature and the hash of the message h(m). -1 u2 = s * rx mod q is calculated using rx and s in the signature. -1 rx mod q.

[0073] Step S22: Calculate the point P'.

[0074] Using the base point G of the elliptic curve, the public key y (which is actually a point composed of the x-coordinate and y-coordinate of the public key point, but here y is sufficient to represent the public key because the public key is a point obtained by scalar multiplication of the base point G with the private key), and the calculated u1 and u2, the point P' = u1 * G + u2 * y is calculated. The addition here is the point addition on the elliptic curve.

[0075] Step S23: Verify whether the signature is valid based on the coordinates of the point P'.

[0076] Check whether the x-coordinate of the point P' is equal to rx in the signature. If equal, the signature is valid; otherwise, the signature is invalid.

[0077] The above verification process ensures that the signature is generated by the signer who owns the corresponding private key, and that the data / message m has not been tampered with during the signing process. This is because an attacker cannot generate a signature that can pass the verification without the correct private key; at the same time, due to the one-wayness and collision resistance of the cryptographic hash function, i.e. the hash function h(m), an attacker cannot generate a hash value that matches the original signature by modifying the data / message m.

[0078] In summary, ECDSA ensures the security and non-falsifiability of the signature through the discrete logarithm problem on the elliptic curve and the secrecy of the random number k. That is, the secrecy of the random number k is also crucial to the security of ECDSA. If k is leaked or reused, an attacker may exploit this weakness to forge a signature or recover the private key of the signer. Therefore, when generating a signature, the randomness and unpredictability of the random number k must be ensured.

[0079] Based on the above cloud service scenario and ECDSA, in order to effectively accelerate ECDSA to improve the efficiency of signature, the process of generating a signature can generally be divided into two stages: pre-computation and online computation.

[0080] In the related art, in the signature generation process based on ECDSA, the calculation of R does not involve the message / data m to be signed, and therefore, the calculation of R can be completed in the pre-computation stage, and s can be calculated online when the message / data m arrives. Since the calculation (rx, ry) = [k]g is a time-consuming operation, the pre-computation of R can effectively speed up ECDSA.

[0081] However, the random number k needs to be used when s is calculated online, and therefore, the random number k needs to be securely stored. As described above, in the case where k is stored in the secure hardware, the secure hardware becomes a performance bottleneck of the signature. In addition, based on the random number k, when s is calculated online, the calculation of the inverse element of k (i.e., k -1 ) is also a time-consuming operation.

[0082] Based on this, the embodiments of the present application provide a signature generation method, for the ECDSA signature algorithm and other signature algorithms that need to use a random number k to generate a signature, a calculated value can be used to generate a signature random number, thereby avoiding the secure storage of the signature random number, and further making the secure hardware used for securely storing data not a bottleneck of the signature.

[0083] Finally, the implementation environment of the embodiments of the present application is introduced.

[0084] FIG. 2 shows a structural schematic diagram of a computer device, which can be a terminal device or a server, or other devices including processors and other hardware, which can be used as a signature device in the embodiments of the present application to execute the steps of the signature generation method.

[0085] Please refer to FIG. 2, which is a structural schematic diagram of a computer device according to an embodiment of the present application. The computer device can be the cloud server 100 shown in FIG. 1, and specifically can be secure hardware in the cloud server. The computer device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.

[0086] The processor 201 can be a general central processing unit (CPU), a network processing unit (NP), a microprocessor, or can be one or more integrated circuits used to implement the schemes of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0087] The communication bus 202 is used to transmit information between the above-mentioned components. The communication bus 202 can be divided into an address bus, a data bus, a control bus, and the like. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0088] The memory 203 can be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disk (including a compact disc read-only memory (CD-ROM), a compressed disk, a laser disk, a digital versatile disk, a Blu-ray disk, and the like), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but is not limited thereto. The memory 203 can exist independently and be connected to the processor 201 through the communication bus 202. The memory 203 can also be integrated with the processor 201.

[0089] ​The communication interface 204 uses any transceiver-like mechanism for communicating with other devices or communication networks. The communication interface 204 includes a wired communication interface and can also include a wireless communication interface. The wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be, for example, a wireless local area networks (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0090] As an example, the processor 201 can include one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 2.

[0091] As an example, the computer device can include multiple processors, such as the processor 201 and the processor 205 as shown in FIG. 2. Each of these processors can be a single-core processor or a multi-core processor. The processor herein can refer to one or more devices, circuits, and / or processing cores for processing data, such as computer program instructions.

[0092] In some embodiments, the computer device can also include an output device and an input device. The output device is in communication with the processor 201 and can display information in various ways. For example, the output device can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device is in communication with the processor 201 and can receive user input in various ways. For example, the input device can be a mouse, a keyboard, a touch screen device, or a sensor device, etc.

[0093] In some embodiments, the memory 203 is used to store program code 210 for implementing the solutions of the present application, and the processor 201 can execute the program code 210 stored in the memory 203. The program code 210 can include one or more software modules, and the computer device can implement the signature generation method provided in the embodiment of FIG. 3 below by means of the processor 201 and the program code 210 in the memory 203.

[0094] It should be noted that the above application scenarios and exemplary implementation environments described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, as new application scenarios appear and implementation environments evolve, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0095] After introducing the terms, application scenarios and implementation environments related to the embodiments of the present application, next, the signature generation method provided by the embodiments of the present application is explained in detail.

[0096] FIG. 3 is a flowchart of a signature generation method provided by an embodiment of the present application, which is applied to a signature device, which can be the computer device shown in FIG. 2. Please refer to FIG. 3, the method includes the following steps.

[0097] Step 301: obtaining first signature data from a plurality of signature data, the first signature data including a first count value and a first signature parameter, the first signature parameter being determined based on a first signature random number, and the first signature random number being determined based on the first count value.

[0098] The first count value can be the value of a counter, for example, 1, 2, 3, 4, 5, 6, …, n, etc., and the value of the counter is a series of non-repeated natural integers. The embodiments of the present application do not limit the specific value of the first count value in step 301.

[0099] It should be noted that the counter can be used to track the number of generated random numbers in the random number generation process, or as an iteration step when generating a new random number, which ensures that a new random number can be generated based on the current state of the generated random number each time the random number generation function is called. That is, the counter can be regarded as an internal state variable for controlling the iteration process of the random number generation algorithm.

[0100] Since the first signature parameter in the first signature data is determined based on the first signature random number, in order to avoid the case that the generated first signature parameter is the same in the case of the same random number, the embodiments of the present application need to select a signature data that has not been used to generate a signature by the target signature algorithm from the plurality of signature data as the first signature data when obtaining the first signature data.

[0101] In other words, the first signature data is one of the plurality of signature data, and the first signature data has not been used to generate a signature by the target signature algorithm before signing the target data.

[0102] In a possible implementation, the plurality of signature data can be stored in the form of a data table, each table entry in the data table including a signature random number and the data usage state of the signature random number. Based on this, when obtaining the first signature data, the data usage state in each table entry in the data table can be queried to determine a plurality of candidate signature data that has not been used, and then the first signature data is determined from the plurality of candidate signature data.

[0103] It should be understood that for multiple signature data, the data table is only a storage form, and other forms can also be used for storage in actual application. The embodiments of the present application do not limit the specific implementation manner of obtaining the first signature data from the multiple signature data.

[0104] In some embodiments, in order to improve the signature efficiency, the multiple signature data can be generated in a pre-computation stage. When online signature is required, the first signature data is directly obtained to perform the following step 302. In other words, the multiple signature data in step 301 is generated in the pre-computation stage. When the signature device needs to sign a certain message or data information, a signature data can be selected from the multiple signature data generated in the pre-computation stage, and then step 302 is performed to improve the signature efficiency.

[0105] Next, the process of generating multiple signature data in the pre-computation stage is explained in detail.

[0106] The process of generating multiple signature data in the pre-computation stage can include the following steps:

[0107] (1) For each count value in the multiple count values, a signature random number is generated based on a random number generation function and the count value.

[0108] In a possible implementation manner, the random number generation function in the embodiments of the present application can be a pseudo random number generation function (PRF), which can be denoted as PRF(.). The implementation process of generating a signature random number by using the pseudo random number generation function can be: taking the count value and a seed value as inputs of the pseudo random number generation function, and generating a signature random number by using the pseudo random number generation function.

[0109] The seed value is used to derive the signature random number. The seed value can be a signature key of the signature device, i.e., a signature key used by the signer to generate a digital signature.

[0110] In a possible implementation manner, the signature key can be a private key of the signer. Of course, the signature key can also be a master key specially used for digital signature, but it is not necessarily the private key of the signer. In the embodiments of the present application, if the signer uses the master key as the seed value to generate a random number, as long as the verifier has the public key of the master key, the verification operation can be performed. The specific content of the seed value is not limited in the embodiments of the present application.

[0111] As an example, assuming that the count value is denoted as label r , and the private key of the signer is denoted as sk, the signature random number generated by the pseudo random number generator based on the private key of the signer can be denoted as PRF(sk, label r ).

[0112] In the process of generating random numbers, the seed value is the starting point or input value of the pseudo-random number generation algorithm, which determines the initial state of the random number sequence, and in turn determines the subsequent values of the entire random number sequence; the counter can be regarded as an internal state variable for controlling the iteration process of the random number generation algorithm. The pseudo-random number generation function is usually based on one or more mathematical algorithms that use the seed value and the value of the counter to generate random numbers.

[0113] As an example, the initial values of the seed value and the counter are set, where the seed value can be an arbitrarily selected numerical value, and the counter usually starts from 0 or 1. In the iteration of generating random numbers, the current counter value and the seed value are used as inputs to call the pseudo-random number generation function, which internally calculates the next random number according to a specific mathematical algorithm (such as linear congruential generator (LCG), mersenne twister algorithm, etc.). Then, the value of the counter is updated (usually by adding 1 to the counter value) for the next iteration.

[0114] In one possible implementation, the seed value can also be updated during the generation of random numbers, for example, the seed value is updated after each iteration to increase randomness.

[0115] Taking the LCG algorithm as an example, as a commonly used pseudo-random number generation algorithm, the formula for generating random numbers can be X n+1 =(aX n +c)mod m. Where X n is the current random number, X n+1 is the next random number, a, c, m are algorithm parameters (usually fixed), and X0 (i.e. the initial random number) is calculated directly based on the seed value. In this example, the counter can be implicitly represented by the number of iterations, i.e. each time the generation function is called, it is equivalent to incrementing the counter value by 1, and calculating the next random number based on the current count (i.e. the number of generated random numbers) and the seed value (or the updated seed value).

[0116] (2) Generate signature parameters based on the signature random number.

[0117] It should be noted that for different signature algorithms, the way of generating signature parameters based on signature random numbers can be different. Next, taking ECDSA as an example, i.e. assuming that the target signature algorithm in the following step 302 is ECDSA, the way of generating signature parameters based on signature random numbers is introduced.

[0118] In the embodiments of the present application, when signing using ECDSA, the elliptic curve parameters corresponding to ECDSA include the coordinates of the base point (denoted as g) on the elliptic curve and the order (denoted as q) of the base point. Since the random number k and k -1 in ECDSA are both used to calculate the final signature value s, when generating the signature random number based on the random number generation function, k can be directly generated, or k -1 In the two different cases, the process of generating the signature parameter based on the signature random number is also slightly different.

[0119] In the first case, when the signature random number is the first random number, i.e., the random number k used in ECDSA, the process of generating the signature parameter based on the signature random number can be: multiplying the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter includes the x coordinate and the y coordinate of the target point.

[0120] As an example, when the signature random number is k and the signature parameter is the coordinates of the target point R, the target point R can be calculated in the manner of the foregoing step S12, i.e., R = [k]g, g being the base point.

[0121] In the second case, when the signature random number is the inverse element of the first random number, i.e., the random number k -1 used in ECDSA, the process of generating the signature parameter based on the signature random number can be: determining the first random number based on the signature random number; multiplying the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter includes the x coordinate and the y coordinate of the target point.

[0122] As an example, when the signature random number is k -1 and the signature parameter is the coordinates of the target point R, the first random number k can be calculated first according to (k -1 ) -1 , and then the target point R can be calculated in the manner of the foregoing step S12, i.e., R = [k]g, g being the base point.

[0123] (3) Construct and store a plurality of signature data, each signature data including a count value and a signature parameter corresponding to the count value.

[0124] Based on the signature parameter generated in the foregoing step (2), when generating the signature data, the x coordinate and the y coordinate of the target point can be both retained, or only the x coordinate of the target point R can be retained according to the needs of calculating the signature value in ECDSA, and the embodiments of the present application do not limit this.

[0125] Wherein, one signature data can be represented as (label r-i, rx-i). Wherein, label r-i is the signature random number generated in step (1) above for a certain count value i; and rx-i is the x coordinate of the target point R generated in step (2) above.

[0126] As an example, the plurality of signature data generated by the embodiments of the present application can be represented by Table 1 below.

[0127] Table 1

[0128] It should be understood that in actual applications, the embodiments of the present application do not limit the number of signature data generated in advance.

[0129] Step 302: Based on the first signature data, generate the signature of the target data by using the target signature algorithm.

[0130] Wherein, the target signature algorithm can be an algorithm for signing using the first signature random number. For example, the target signature algorithm can be ECDSA.

[0131] Taking ECDSA as the target signature algorithm, the process of generating the signature of the target data by using the target signature algorithm based on the first signature data can be: based on the first count value, generate the first signature random number by using the random number generation function; and according to the first signature random number and the first signature parameter, and the order of the base point on the elliptic curve, generate the signature of the target data by using the target signature algorithm.

[0132] Similarly, when generating the first signature random number by using the random number generation function, the first signature random number can be directly generated, or the inverse element of the first signature random number can be directly generated. Next, the two cases will be introduced respectively.

[0133] In the first case, when the target signature algorithm includes ECDSA, the implementation process of the above step 302 can be: based on the first count value, generate the first signature random number by using the random number generation function; determine the inverse element of the first signature random number; and based on the inverse element of the first signature random number and the first signature parameter, generate the signature of the target data by using the target signature algorithm.

[0134] That is, when the first signature random number is generated by using the random number generation function, the inverse element of the first signature random number needs to be calculated based on the first signature random number by using the inverse method, and then the inverse element of the first signature random number and the first signature parameter are used to generate the signature.

[0135] In the second case, when the target signature algorithm includes ECDSA, the implementation process of step 302 can be: generating an inverse of the first signature random number based on the first count value by using a random number generation function; and generating a signature of the target data based on the inverse of the first signature random number and the first signature parameter by using the target signature algorithm.

[0136] In this case, since the random number generation function can directly generate the inverse of the first signature random number based on the first count value, it means that the inverse of the signature random number calculated by the random number generation function in the pre-computation stage. Since the calculation process of the inverse of the signature random number can be completed in the pre-computation stage, and the calculation of the inverse of the signature random number itself is also a time-consuming operation in the signature process, calculating the inverse of the signature random number and the signature parameter in the pre-computation stage is equivalent to pushing all time-consuming calculations in ECDSA to the pre-computation stage, which can greatly improve the efficiency of the subsequent online signature.

[0137] It should be noted that the implementation process of generating the signature of the target data based on the inverse of the first signature random number and the first signature data by using ECDSA can refer to steps S13 and S14 described above, and will not be described here.

[0138] In summary, when signing the target data, the embodiments of the present application can directly call the first signature data from the plurality of signature data, without the need to calculate and generate the first signature data in real time, thereby improving the efficiency of online signature. Moreover, for each signature data in the plurality of signature data, since the signature data includes a count value used to determine the signature random number, rather than the signature random number itself, even if the count value is stolen, it is difficult to derive the corresponding signature random number, so there is no need to securely store the count value, and the signature process will not be limited by the resource bottleneck of the secure hardware storing the signature random number.

[0139] Based on the above signature generation method embodiments, in order to facilitate understanding, taking the cloud server calling the secure hardware (possessing the signature private key sk) as an example, assuming that the signature algorithm is ECDSA, the base point of the elliptic curve is g, and the order is q, next, the process of generating and storing the signature data in the pre-computation stage and signing the data m in the online calculation stage is exemplarily described.

[0140] Example one, the pseudo-random number generation function PRF(.) is used to generate the random number k.

[0141] The implementation process of generating the signature data in the pre-computation stage can be: the secure hardware selects a non-repetitive (i.e., unused) label r (label r as the count value of the counter), and sets k = PRF(sk, label rThe secure hardware calculates R = (rx, ry) = [k]g; the secure hardware outputs signature data (label). r (rx).

[0142] The process of generating a signature for data m during the online computation phase can be as follows: Select an unused (label) r The input (rx) is given to the security hardware, which calculates k = PRF(sk, label). r Then calculate k. -1 Then calculate the signature value s = k -1 (h(m)+rx*sk)(mod q). Finally, output (rx, s) as the signature of the data m.

[0143] In this example, since the pre-computed random number k is generated based on a pseudo-random number generation function, there is no need to securely store the pre-computed result, thus making the signing process unaffected by security hardware resource bottlenecks.

[0144] Example 2: The pseudo-random number generation function PRF(.) is used to generate the inverse of a random number k, i.e., k -1 .

[0145] The process of generating signature data during the pre-computation phase can be as follows: the security hardware selects a unique (i.e., unused) label. r (label r (This is the counter's count value), and set k. -1 =PRF(sk, label) r ); Security hardware calculation k = (k -1 ) -1 Then calculate R = (rx, ry) = [k]g; the secure hardware outputs signature data (label). r (rx).

[0146] The process of generating a signature for data m during the online computation phase can be as follows: Select an unused (label) r (rx) is input to the security hardware, and the security hardware calculates k. -1 =PRF(sk, label) r Then calculate the signature value s = k -1 (h(m)+rx*sk)(mod q). Finally, output (rx, s) as the signature of the data m.

[0147] In this example, R and k will be calculated in the ECDSA signature. -1The operations of the signature generation device are pushed to the pre-computation stage, so that a large number of time-consuming calculations can be completed in advance in the pre-computation stage, thereby improving the signature efficiency in the online calculation stage. Similarly, since the random number in this way is also generated based on the pseudo-random number generation function, there is no need to securely store the pre-computed results, so that the signature process is not affected by the security hardware resource bottleneck.

[0148] FIG. 4 is a structural schematic diagram of a signature generation device provided by an embodiment of the present application. The signature generation device can be realized by software, hardware or a combination of both to become part or all of a signature device, which can be the computer device shown in FIG. 2. Referring to FIG. 4, the signature generation device includes a data acquisition module 401 and a signature module 402.

[0149] The data acquisition module 401 is configured to acquire first signature data from a plurality of signature data, the first signature data including a first count value and a first signature parameter, the first signature parameter being determined based on a first signature random number, and the first signature random number being determined based on the first count value.

[0150] The signature module 402 is configured to generate a signature of target data by a target signature algorithm based on the first signature data.

[0151] In a possible implementation, the signature generation device further includes:

[0152] The random number generation module is configured to, for each count value in the plurality of count values, generate a signature random number based on a random number generation function and the count value.

[0153] The parameter calculation module is configured to generate a signature parameter based on the signature random number.

[0154] The data storage module is configured to construct and store a plurality of signature data, each signature data including a count value and a signature parameter corresponding to the count value.

[0155] In a possible implementation, the random number generation function is a pseudo-random number generation function.

[0156] The random number generation module is specifically configured to:

[0157] input the count value and a seed value into the pseudo-random number generation function as inputs of the pseudo-random number generation function, and generate the signature random number by the pseudo-random number generation function, the seed value being used to derive the signature random number.

[0158] In a possible implementation, the seed value includes a signature key of the signature device.

[0159] In a possible implementation, the first signature data is one of the plurality of signature data, and the first signature data is not used to generate a signature by the target signature algorithm before the target data is signed.

[0160] In a possible implementation, the target signature algorithm is an elliptic curve cryptography based digital signature algorithm ECDSA, and elliptic curve parameters corresponding to the ECDSA include coordinates of a base point on an elliptic curve and an order of the base point.

[0161] In a possible implementation, the signature random number includes a first random number.

[0162] The parameter calculation module is specifically configured to:

[0163] multiply the first random number and the coordinates of the base point to obtain a signature parameter, wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter includes an x-coordinate and a y-coordinate of the target point.

[0164] In a possible implementation, the signature random number includes an inverse element of the first random number, and the parameter calculation module is specifically configured to:

[0165] determine the first random number based on the signature random number.

[0166] multiply the first random number and the coordinates of the base point to obtain a signature parameter, wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter includes an x-coordinate and a y-coordinate of the target point.

[0167] In a possible implementation, the target signature algorithm is an elliptic curve cryptography based digital signature algorithm ECDSA, and the signature module 402 is specifically configured to:

[0168] generate, based on the first count value, an inverse element of the first signature random number by using a random number generation function.

[0169] determine the inverse element of the first signature random number.

[0170] generate, based on the inverse element of the first signature random number and the first signature parameter, a signature of the target data by using the target signature algorithm.

[0171] In a possible implementation, the target signature algorithm is an elliptic curve cryptography based digital signature algorithm ECDSA, and the signature module 402 is specifically configured to:

[0172] generate, based on the first count value, an inverse element of the first signature random number by using a random number generation function.

[0173] generate, based on the inverse element of the first signature random number and the first signature parameter, a signature of the target data by using the target signature algorithm.

[0174] In summary, when signing the target data, the embodiment of the present application can directly call the first signature data from the plurality of signature data, without real-time calculation and generation of the first signature data, thereby improving the efficiency of online signature. Moreover, for each signature data in the plurality of signature data, since the signature data includes the count value for determining the signature random number, rather than the signature random number itself, even if the count value is stolen, it is difficult to derive the corresponding signature random number, so the count value does not need to be stored securely, and the signature process is not limited by the resource bottleneck of the secure hardware for storing the signature random number.

[0175] It should be noted that the signature generation apparatus provided by the above embodiment, when generating the signature of the target data, is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the apparatus is divided into different functional modules to complete all or part of the functions described above. In addition, the signature generation apparatus and the signature generation method provided by the above embodiment belong to the same concept, and the specific implementation process is described in detail in the method embodiment, which will not be repeated here.

[0176] The embodiment of the present application further provides a computer readable storage medium, wherein the storage medium stores instructions, when the instructions run on the computer, the computer executes the steps of the signature generation method shown in the above embodiment.

[0177] The embodiment of the present application further provides a computer program product containing instructions, when the instructions run on the computer, the computer executes the steps of the signature generation method shown in the above embodiment. Or, a computer program is provided, when the computer program runs on the computer, the computer executes the steps of the signature generation method shown in the above embodiment.

[0178] In the above embodiments, all or part can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (for example: coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example: infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example: floppy disk, hard disk, magnetic tape), optical media (for example: digital versatile disc (DVD)) or semiconductor media (for example: solid state disk (SSD)) and the like. It should be noted that the computer-readable storage medium mentioned in the embodiments of the present application can be a non-volatile storage medium, in other words, it can be a non-transitory storage medium.

[0179] It should be understood that "multiple" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " represents the meaning of or, for example, A / B can represent A or B; "and / or" herein only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist together, and B exists alone. In addition, in order to clearly describe the technical solutions of the embodiments of the present application, "first", "second" and the like are used to distinguish the same items or similar items with basically the same function and role in the embodiments of the present application. Those skilled in the art can understand that "first", "second" and the like do not limit the quantity and execution order, and "first", "second" and the like do not necessarily mean different.

[0180] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of the present application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0181] The above describes the embodiments provided by the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A signature generation method characterized by comprising: The method comprises: obtaining first signature data from a plurality of signature data, the first signature data comprising a first count value and a first signature parameter, the first signature parameter being determined based on a first signature random number, and the first signature random number being determined based on the first count value; generating a signature of target data by a target signature algorithm based on the first signature data.

2. The method of claim 1, wherein, Before the obtaining first signature data from a plurality of signature data, the method further comprises: for each count value in a plurality of count values, generating a signature random number based on a random number generation function and the count value; generating a signature parameter based on the signature random number; constructing and storing the plurality of signature data, each signature data comprising a count value and a signature parameter corresponding to the count value.

3. The method of claim 2, wherein, The random number generation function is a pseudo-random number generation function; The generating a signature random number based on the random number generation function and the count value comprises: inputting the count value and a seed value as inputs of the pseudo-random number generation function, and generating the signature random number by the pseudo-random number generation function, the seed value being used to derive the signature random number.

4. The method of claim 3, wherein, The seed value comprises a signature key of a signature device.

5. The method according to any one of claims 2 to 4, wherein, The first signature data is one of the plurality of signature data, and the first signature data is not used to generate a signature by the target signature algorithm before the target data is signed.

6. The method according to any one of claims 2 to 5, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA, and elliptic curve parameters corresponding to the ECDSA comprise coordinates of a base point on an elliptic curve and an order of the base point.

7. The method of claim 6, wherein, The signature random number comprises a first random number; The generating a signature parameter based on the signature random number comprises: multiplying the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter comprises an x-coordinate and a y-coordinate of the target point.

8. The method of claim 6, wherein, The signature random number comprises an inverse of a first random number; The generating a signature parameter based on the signature random number comprises: determining the first random number based on the signature random number; multiplying the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter comprises an x-coordinate and a y-coordinate of the target point.

9. The method according to any one of claims 1 to 8, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA; The generating a signature of target data by a target signature algorithm based on the first signature data comprises: generating the first signature random number by the random number generation function based on the first count value; determining an inverse of the first signature random number; generating the signature of the target data by the target signature algorithm based on the inverse of the first signature random number and the first signature parameter.

10. The method of any one of claims 1-8, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA; The generating a signature of target data by a target signature algorithm based on the first signature data comprises: generating, based on the first count value, an inverse of the first signature random number by the random number generation function; generating, based on the inverse of the first signature random number and the first signature parameter, a signature of the target data by the target signature algorithm.

11. A signature generation apparatus characterized by comprising: The apparatus comprises: a data obtaining module configured to obtain first signature data from a plurality of signature data, the first signature data comprising a first count value and a first signature parameter, the first signature parameter being determined based on a first signature random number, and the first signature random number being determined based on the first count value; a signature module configured to generate, based on the first signature data, a signature of target data by a target signature algorithm.

12. The apparatus of claim 11, wherein, The apparatus further comprises: a random number generation module configured to, for each count value in a plurality of count values, generate a signature random number based on a random number generation function and the count value; a parameter calculation module configured to generate a signature parameter based on the signature random number; a data storage module configured to construct and store the plurality of signature data, each signature data comprising a count value and a signature parameter corresponding to the count value.

13. The apparatus of claim 12, wherein, The random number generation function is a pseudo-random number generation function; The random number generation module is specifically configured to: input the count value and a seed value into the pseudo-random number generation function as inputs of the pseudo-random number generation function, and generate the signature random number by the pseudo-random number generation function, the seed value being used to derive the signature random number.

14. The apparatus of claim 13, wherein, The seed value comprises a signature key of a signature device.

15. The apparatus of any one of claims 12-14, wherein, The first signature data is one of the plurality of signature data, and the first signature data is not used to generate a signature by the target signature algorithm before the target data is signed.

16. The apparatus of any one of claims 12-15, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA, and elliptic curve parameters corresponding to the ECDSA comprise coordinates of a base point on an elliptic curve and an order of the base point.

17. The apparatus of claim 16, wherein, The signature random number comprises a first random number; The parameter calculation module is specifically configured to: multiply the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter comprises x and y coordinates of the target point.

18. The apparatus of claim 16, wherein, The signature random number comprises an inverse of a first random number; The parameter calculation module is specifically configured to: determine the first random number based on the signature random number; multiply the first random number and the coordinates of the base point to obtain the signature parameter; wherein the signature parameter is used to indicate a target point on the elliptic curve, and the signature parameter comprises x and y coordinates of the target point.

19. The apparatus of any one of claims 11-18, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA; The signature module is specifically configured to: generate, based on the first count value, the first signature random number by the random number generation function; determine an inverse of the first signature random number; generate, based on the inverse of the first signature random number and the first signature parameter, a signature of the target data by the target signature algorithm.

20. The apparatus of any one of claims 11-18, wherein, The target signature algorithm is an elliptic curve cryptography-based digital signature algorithm ECDSA; The signature module is specifically configured to: generate, based on the first count value, an inverse of the first signature random number through the random number generation function; generate, based on the inverse of the first signature random number and the first signature parameter, a signature of the target data through the target signature algorithm.

21. A computer device, comprising: The computer device comprises a processor and a memory; The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the signature generation method according to any one of claims 1-10.

22. A computer-readable storage medium, characterized in that, The storage medium has stored therein a computer program, which, when executed by a processor, implements the signature generation method according to any one of claims 1-10.

23. A computer program product, characterised in that, The computer program product has stored therein computer instructions, which, when executed by a processor, implement the signature generation method according to any one of claims 1-10.

Images