CN109831312B - Connectable ring signature method, device, equipment and storage medium - Google Patents

Abstract

The present invention provides a connectable ring signature method, device, device and storage medium. The method includes: acquiring security parameters and information to be encrypted; generating system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second Hash function, first generator and second generator; generate a public-private key pair set according to system parameters; wherein, the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key; according to The set of information to be encrypted, system parameters, and public-private key pairs determines a signature that conforms to a preset structure; the preset structure includes a first label, signature elements, multiple powers, and an inner product argument; the inner product argument is the inner product argument of the first vector , the first vector includes a third label, a multi-power, a challenge, a first random sub-vector, and a second random sub-vector. This method reduces the communication complexity of the signature to O(log ₂ (n)) without reducing the security, and reduces the storage and communication costs.

Description

Connectable ring signature method, apparatus, device, and storage medium

technical field

The present invention relates to the technical field of digital signatures, and in particular, to a connectable ring signature method, apparatus, device and storage medium.

Background technique

Connectable ring signature is a ring signature-based technology that can sign messages without revealing the user's identity, and increases connectability, which allows duplicate signatures of malicious users to be discovered. Based on the above characteristics, connectable ring signatures are used in cryptocurrencies to achieve transaction anonymity while resisting double spending.

However, without the use of bilinear pairings, the communication complexity of the existing connectable ring signatures is O(n), which leads to a linear increase in the length of the signature with the increase of users, which in turn increases storage and communication. cost.

SUMMARY OF THE INVENTION

The present invention provides a connectable ring signature method, device, device and storage medium to solve the technical problem of increased storage and communication costs as the length of the existing connectable ring signature increases linearly with the increase of users.

In a first aspect, the present invention provides a connectable ring signature method, the method comprising:

Obtain security parameters and information to be encrypted;

Generate system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator;

Generate a public-private key pair set according to the system parameters; wherein, the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key;

According to the to-be-encrypted information, the system parameters, and the set of public-private key pairs, a signature conforming to a preset structure is determined; wherein the preset structure includes a first label, signature elements, multiple powers, and inner product arguments; the An inner product argument is an inner product argument for a first vector that includes a third label, a multiplicity of powers, a challenge, a first random sub-vector, and a second random sub-vector.

In a connectable ring signature method provided by the present invention, system parameters are generated according to security parameters, a set of public and private key pairs is generated according to the system parameters, and a signature is determined according to the information to be encrypted, the system parameters and the set of public and private key pairs, so that the signature includes the first One label, signature element, multiple powers, and inner product arguments reduce the communication complexity of the signature to O(log ₂ (n)) without reducing security, reducing storage and communication costs.

Optionally, the first label is specifically:

Among them, h _j is the j-th hash public key, h _j =H _G (pk _j ), sk _j represents the j-th private key, H _G represents the first hash function, and pk _j represents the j-th private key corresponding to 's public key.

Optionally, the signature element is specifically:

r=α-c _j sk _j

c′表示挑战，c′＝H_Z(L，d)，H_Z表示第二哈希函数，

g表示第一生成元，d表示第二标签，d＝H_Z(pk₁，pk₂，...，pk_n，t，m)，n表示公私钥对集合中公私钥对的数量，c₁，c₂，...，c_j-1，c_j+1，...，c_n分别表示n-1个随机数，m表示输入消息。where α is a random number,

c' represents the challenge, c'=H _Z (L, d), H _Z represents the second hash function,

g represents the first generator, d represents the second label, d=H _Z (pk ₁ , pk ₂ , ..., pk _n , t, m), n represents the number of public-private key pairs in the set of public-private key pairs, c ₁ , c ₂ , ..., c _j-1 , c _j+1 , ..., c _n respectively represent n-1 random numbers, and m represents the input message.

Optionally, the multiple powers are specifically:

Among them, P represents multiple powers.

Optionally, the first vector is specifically:

W=(pk _i ^d _hi , P, c', C, E)

Wherein, W is the first vector, p _i ^d _hi is the third label, C is the first random sub-vector, C=(c ₁ , c ₂ ,..., c _j-1 , c _j , c _{j+ 1} , . . . , cn ), E represents the second random sub- _vector , E=(1, 1, . . . , 1).

The connectable ring signature device will be introduced below, and its implementation principle and technical effect are similar to those of the above-mentioned method, and will not be repeated here.

In a second aspect, the present invention provides a connectable ring signature device, the device comprising:

The acquisition module is used to acquire security parameters and information to be encrypted;

a generating module, configured to generate system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator;

The generating module is further configured to generate a public-private key pair set according to the system parameter; wherein the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key;

A determination module, configured to use the system parameters and the set of public-private key pairs to determine a signature conforming to a preset structure for the information to be encrypted; wherein the preset structure includes a first label, a signature element, a multi-power and an internal Product argument; the inner product argument is an inner product argument of a first vector, and the first vector includes a third label, a multi-power, a challenge, a first random sub-vector, and a second random sub-vector.

Optionally, the first label is specifically:

Among them, h _j is the j-th hash public key, h _j =H _G (pk _j ), sk _j represents the j-th private key, H _G represents the first hash function, and pk _j represents the j-th private key corresponding to 's public key.

Optionally, the signature element is specifically:

r=α-c _j sk _j

c′表示挑战，c′＝H_Z(L，d)，H_Z表示第二哈希函数，

g表示第一生成元，d表示第二标签，d＝H_Z(pk₁，pk₂，...，pk_n，t，m)，n表示公私钥对集合中公私钥对的数量，c₁，c₂，...，c_j-1，c_j+1，...，c_n分别表示n-1个随机数，m表示输入消息。where α is a random number,

c' represents the challenge, c'=H _Z (L, d), H _Z represents the second hash function,

g represents the first generator, d represents the second label, d=H _Z (pk ₁ , pk ₂ , ..., pk _n , t, m), n represents the number of public-private key pairs in the set of public-private key pairs, c ₁ , c ₂ , ..., c _j-1 , c _j+1 , ... , c _n respectively represent n-1 random numbers, and m represents the input message.

In a third aspect, the present invention provides an electronic device, comprising: at least one processor and a memory;

wherein, the memory stores computer-executed instructions;

The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the connectable ring signature method involved in the first aspect and the optional solution.

In a fourth aspect, the present invention provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when a processor executes the computer-executable instructions, the first aspect and the optional solution are implemented. Linkable ring signature method.

The present invention provides a connectable ring signature method, device, equipment and storage medium. In the connectable ring signature method provided by the present invention, the signature is determined according to the information to be encrypted, the system parameter and the set of public and private key pairs, so that the signature includes the first Labels, signature elements, multiple powers, and inner product arguments reduce the communication complexity of signatures to O(log ₂ (n)) without reducing security, reducing storage and communication costs. The connectable ring signature method provided by the present invention is applied to the fields of electronic voting, digital currency, identity authentication and the like, and can greatly reduce the communication data in the above fields.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic flowchart of a connectable ring signature method according to an exemplary embodiment of the present invention;

2 is a schematic structural diagram of a connectable ring signature device according to an exemplary embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The present invention provides a connectable ring signature method, device, device and storage medium to solve the technical problem of increased storage and communication costs as the length of the existing connectable ring signature increases linearly with the increase of users.

FIG. 1 is a schematic flowchart of a connectable ring signature method according to an exemplary embodiment of the present invention. As shown in FIG. 1 , the connectable ring signature method provided by this embodiment includes the following steps:

S101. Obtain security parameters and information to be encrypted.

More specifically, the information to be encrypted and the security parameters are both input by the user, and the user determines the security parameters according to factors such as the degree of confidentiality of the information to be encrypted, encryption requirements and other factors. This embodiment is not limited to factors such as the degree of confidentiality of the information to be encrypted, encryption requirements, and other factors, and may also be other factors that affect the encryption process of the information to be encrypted.

S102. Generate system parameters according to the security parameters.

More specifically, the system parameters are generated according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator. The way of generating the system parameters by the security parameters is a common way in the prior art.

For example: the user inputs the security parameter λ and outputs the system parameter pm. The system parameter pm includes: a first hash function H _G , a second hash function H _Z , a first generator g and a second generator h.

S103. Generate a set of public and private key pairs according to system parameters.

More specifically, a set of public-private key pairs is generated according to system parameters, wherein the set of public-private key pairs includes multiple groups of public-private key pairs, and each public-private key pair includes a public key and a private key matching the public key. The way of generating the public-private key pair according to the system parameters is the way commonly used in the prior art.

For example: generate the public key pk _i and the private key _ski according to the system parameter pm. Among them, 1≤i≤n and public key pk _i is published.

S104. Determine a signature conforming to a preset structure according to the information to be encrypted, the system parameter, and the set of public-private key pairs.

More specifically, the preset structure includes a first label, a signature element, multiple powers, and an inner product argument; the inner product argument is an inner product argument for a first vector, and the first vector includes a third label, multiple powers, challenges, and a first random. sub-vector and a second random sub-vector.

In this embodiment, the signature conforming to the preset structure is obtained according to the following steps:

S201. Calculate n hash public keys by using the first hash function n times, and specifically obtain the hash public keys according to formula (1).

h _i =H _G (pk _i ) (1)

Among them, hi represents the _ith public key hash, H _G represents the first hash function, pk _i represents the ith public key, and ski represents the private key corresponding to the _ith public key pk _i .

S202: Calculate the first label t according to the hashed public key and the private key, and specifically obtain the first label according to formula (2).

Among them, t represents the first tag, h _j represents the j-th hash public key, and sk _j represents the private key corresponding to the j-th public key pk _j .

S203. Generate a second label according to the second hash function, n public keys, the first label t, and the message to be encrypted, and specifically obtain the second label according to formula (3).

d=H _Z (pk ₁ , pk ₂ , , . . , pk _n , t, m) (3)

Wherein, p _i represents the ith public key, t represents the first tag, m represents the message to be encrypted, H _Z represents the second hash function, and d represents the second tag.

S204. Generate a commitment according to the hash public key, the first tag, the second hash function, the system parameters, and the public key, and specifically obtain the commitment according to formula (4).

Among them, L represents the commitment, g represents the first generator in the system parameters, d represents the second label, t represents the first label, α represents the random number, p _i represents the ith public key, and hi represents the _ith hash The public key, ci represents the _ith random number.

S205. Generate a challenge according to the second label and the commitment, and specifically obtain the challenge according to formula (5).

c′=H _Z (L, d) (5)

Among them, c' represents the challenge, L represents the commitment, d represents the second label, and H _Z represents the second hash function.

S206. Generate a first random sub-vector, and specifically obtain the first random sub-vector according to formula (6).

C=(c ₁ , c ₂ , ..., c _j-1 , c _j , c _j+1 , ..., c _n ) (6)

为分别表示n-1个随机数。where C represents the first random sub-vector,

to represent n-1 random numbers respectively.

S207 , calculating the signature element, specifically calculating the signature element according to formula (7).

r=α-c _j sk _j (7)

c₁，c₂，...，c_j-1，c_j+1，...，c_n为分别表示n-1个随机数，sk_j表示第j个私钥。Among them, r represents the signature element, α represents the random number,

c ₁ , c ₂ , ..., c _j-1 , c _j+1 , ..., c _n respectively represent n-1 random numbers, and sk _j represents the jth private key.

S208: Calculate the multi-power, and specifically calculate the multi-power according to formula (8).

Among them, P represents multiple powers, g represents the first generator in the system parameters, d represents the second label, t represents the first label, r represents the signature element, and L represents the commitment.

S209 , generating a second random sub-vector, specifically generating a second random sub-vector according to formula (9).

E=(1,1,...1) (9)

Among them, E is an n-dimensional vector.

S210. Calculate the inner product argument of the first vector.

The first vector is specifically shown in formula (10):

W=(pk _i ^a _hi , P, c', C, E) (10)

Among them, W is the first vector, pk _i ^d _hi represents the third label, C represents the first random sub-vector, E represents the second random sub-vector, p _i represents the ith public key, and d represents the second label.

After calculating the inner product argument π of the first vector using the existing inner product argument algorithm,

S211. Output the signature σ=(t, r, P, π).

Among them, t represents the first label, r represents the signature element, P represents the multiple power, and π represents the inner product argument of the first vector W.

where the size of the argument is 2log ₂ n+1. Accordingly, the size of the signature is 2log ₂ n+4.

Next, the received signature is verified and connected, and the following calculation is performed according to the signature σ, n public keys pk ₁ , pk ₂ , . . . , pk _n and the message m to be encrypted:

S301. Calculate n hash public keys by using the first hash function n times, that is, calculate n hash public keys according to the formula h _i =H _G (pk _i ).

S302. Calculate the second label by using the second hash function, that is, calculate the second label according to the formula d=H _Z (pk ₁ , pk ₂ , . . . , pk _n , t, m).

计算承诺。S303. Calculate the commitment, that is, according to the formula

Calculate commitment.

S304. Calculate the challenge through the second hash function, that is, calculate the challenge according to the formula c=H _Z (L, d).

S305 , using the existing inner product argumentation algorithm, verify whether the inner product argument π is correct through (pk _i ^d _hi , P, c). If correct, accept the signature; otherwise reject.

Perform connection processing on the two signatures σ ₁ , σ ₂ , verify whether the first labels t ₁ , t ₂ in the two signatures σ ₁ , σ ₂ are equal, if they are equal, connect the two signatures; otherwise, do not connect.

In the method provided by this embodiment, the signature is determined according to the information to be encrypted, the system parameters, and the set of public-private key pairs, so that the signature includes the first label, the signature element, the multi-power and the inner product argument. On the premise of not reducing the security, Reduces the communication complexity of the signature to O(log ₂ (n)), reducing storage and communication costs.

The present invention provides a comparative example. In the comparative example, the following steps are used to encrypt the information to be encrypted:

The steps of S401 and S401 are the same as the steps of S101 in the embodiment shown in FIG. 1 .

The steps of S402 and S402 are the same as the steps of S102 in the embodiment shown in FIG. 1 .

S403. Generate a signature.

Specifically, input message m, n public keys pk ₁ , pk ₂ , . . . , pk _n , and a private key sk. The public key corresponding to the private key sk is pk _j . Do the following calculations:

S501. Calculate the label t=H _G (g) ^sk .

S502. Generate a random number α as the first random number.

S503. Generate n-1 random numbers c ₁ , c ₂ , . . . , c _j-1 , c _j+1 , . . . , c _n as a first vector.

S504. Calculation commitment

S505. Calculate the challenge through the second hash function

将c_j补充进入第一向量。S506. Calculation

Supplement c _j into the first vector.

S507. Calculate the signature element r=α-c _j sk.

S508, output the signature σ=(t, r, c ₁ , c ₂ , . . . , c _n ).

And the signature is verified: according to the signature σ, the n public keys pk ₁ , pk ₂ , ..., pk _n and the message m are calculated as follows:

S601. Calculation commitment

并验证

是否等于c。如果相等，接受签名；否则拒绝。S602. Calculate the challenge through the second hash function

and verify

is equal to c. If equal, accept the signature; otherwise reject.

Perform connection processing on two signatures σ ₁ , σ ₂ : verify whether the first labels t ₁ , t ₂ in the two signatures σ ₁ , σ ₂ are equal, if they are equal, connect the two signatures; otherwise, do not connect.

In the comparative example, the size of the output signature σ=(t, r, c ₁ , c ₂ , . . . , c _n ) is n+2. The size of the signature increases linearly with ring membership. However, in the connectable ring signature method provided by the present invention, the size of the signature is 2log ₂ n+4, and the number of ring members grows logarithmically. The concatenated ring signature method greatly reduces the length of the signature without compromising security. The adversary cannot find the actual signer of the connectable ring signature among the ring members, and cannot forge a valid connectable ring signature, which is anonymous and unforgeable.

FIG. 2 is a schematic structural diagram of a connectable ring signature device according to an exemplary embodiment of the present invention. As shown in FIG. 2 , the connectable ring signature device 700 provided in this embodiment includes:

an acquisition module 701, used to acquire security parameters and information to be encrypted;

A generating module 702, configured to generate system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator;

The generating module 702 is further configured to generate a public-private key pair set according to the system parameters; wherein the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key ;

A determination module 703, configured to use the system parameters and the set of public-private key pairs to determine a signature conforming to a preset structure for the information to be encrypted; wherein the preset structure includes a first label, a signature element, a multi-power, and Inner product argument; the inner product argument is an inner product argument of a first vector, and the first vector includes a third label, a multi-power, a challenge, a first random sub-vector, and a second random sub-vector.

Optionally, the first label is specifically:

Among them, h _j is the j-th hash public key, h _j =H _G (pk _j ), sk _j represents the j-th private key, H _G represents the first hash function, and pk _j represents the j-th private key corresponding to 's public key.

Optionally, the signature element is specifically:

r=α-c _j sk _j

c′表示挑战，c′＝H_Z(L，d)，H_Z表示第二哈希函数，

g表示第一生成元，d表示第二标签，d＝H_Z(pk₁，pk₂，...，pk_n，t，m)，n表示公私钥对集合中公私钥对的数量，c₁，c₂，...，c_j-1，c_j+1，...，c_n分别表示n-1个随机数，m表示输入消息。where α is a random number,

c' represents the challenge, c'=H _Z (L, d), H _Z represents the second hash function,

g represents the first generator, d represents the second label, d=H _Z (pk ₁ , pk ₂ , ..., pk _n , t, m), n represents the number of public-private key pairs in the set of public-private key pairs, c ₁ , c ₂ , ..., c _j-1 , c _j+1 , ..., c _n respectively represent n-1 random numbers, and m represents the input message.

In a word, the connectable ring signature device provided in this application can be used to execute the above connectable ring signature method, and the content and effect thereof can refer to the method section, which will not be repeated in this application.

FIG. 3 is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present invention. As shown in FIG. 3, the electronic device 800 in this embodiment includes: a processor 801 and a memory 802, wherein,

a memory 802 for storing computer-executed instructions;

The processor 801 is configured to execute computer-executed instructions stored in the memory, so as to implement various steps performed by the receiving device in the above-mentioned embodiments. For details, refer to the relevant descriptions in the foregoing method embodiments.

Optionally, the memory 802 may be independent or integrated with the processor 801 .

When the memory 802 is set independently, the electronic device 800 further includes a bus 803 for connecting the memory 802 and the processor 801 .

Embodiments of the present invention further provide a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the processor executes the computer-executable instructions, the above-mentioned connectable ring signature method is implemented.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present invention. scope.

Claims (4)

1. A connectable ring signature method, wherein the method comprises: Obtain security parameters and information to be encrypted; Generate system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator; Generate a public-private key pair set according to the system parameters; wherein, the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key; According to the to-be-encrypted information, the system parameters, and the set of public-private key pairs, a signature conforming to a preset structure is determined; wherein, the preset structure includes a first label, signature elements, multiple powers, and inner product arguments; the The inner product argument is an inner product argument of a first vector including a third label, a multi-power, a challenge, a first random sub-vector, and a second random sub-vector; Wherein, determining the signature conforming to the preset structure according to the information to be encrypted, the system parameter and the set of public-private key pairs includes: The n hash public keys are calculated by the first hash function n times, and the formula (1) used is as follows: h _i =H _G (pk _i ) (1) In formula (1), hi represents the _ith public key hash, H _G represents the first hash function, pk _i represents the ith public key, and ski represents the private key corresponding to the _ith public key pk _i ; The first label t is calculated according to the hash public key and private key, and the formula (2) used is as follows:

In formula (2), t represents the first tag, h _j represents the jth hash public key, and sk _j represents the private key corresponding to the jth public key pk _j ; The second label is generated according to the second hash function, n public keys, the first label t and the message to be encrypted, and the formula (3) used is as follows: d=H _z (pk ₁ ,pk ₂ ,...,pk _n ,t,m) (3) In formula (3), pk _i represents the ith public key, t represents the first tag, m represents the message to be encrypted, H _Z represents the second hash function, and d represents the second tag; According to the hash public key, the first tag, the second hash function, the system parameters and the public key to generate the commitment, the formula (4) used is as follows:

In formula (4), L represents commitment, g represents the first generator in the system parameters, d represents the second label, t represents the first label, α represents a random number, p _i represents the _ith public key, and hi represents The i-th hash public key, c _i represents the i-th random number; The challenge is generated according to the second label and commitment, and the utilized formula (5) is as follows: c′=H _Z (L,d) (5) In formula (5), c′ represents the challenge, L represents the commitment, d represents the second label, and H _Z represents the second hash function; To generate the first random sub-vector, the formula (6) used is as follows: C=(c ₁ ,c ₂ ,...,c _j-1 ,c _j ,c _j+1 ,...,c _n ) (6) In formula (6), C represents the first random sub-vector,

c ₁ ,c ₂ ,...,c _j-1 ,c _j+1 ,...,c _n represent n-1 random numbers respectively; To calculate the signature element, the formula (7) used is as follows: r=α-c _j sk _j (7) In formula (7), r represents the signature element, α represents a random number,

c ₁ ,c ₂ ,...,c _j-1 ,c _j+1 ,...,cn are _n -1 random numbers, respectively, and sk _j is the jth private key; To calculate multiple powers, the formula (8) used is as follows:

In formula (8), P represents multiple powers, g represents the first generator in the system parameters, d represents the second label, t represents the first label, r represents the signature element, and L represents the commitment; To generate the second random sub-vector, the formula (9) used is as follows: E=(1,1,...1) (9) In formula (9), E is the second random sub-vector; To calculate the first vector, the formula (10) used is as follows: W=(pk _i ^d h _i ,P,c′,C,E) (10) In formula (10), W is the first vector, p _i ^d h _i is the third label, C is the first random sub-vector, E is the second random sub-vector, p _i is the i-th public key, and d is the second label; Calculate the inner product argument π of the first vector; output signature σ=(t,r,P,π); Among them, t represents the first label, r represents the signature element, P represents the multiple power, and π represents the inner product argument of the first vector W, the size of the argument is 2log ₂ n+1, and the size of the signature is 2log ₂ n +4. 2. A connectable ring signature device, wherein the device comprises: The acquisition module is used to acquire security parameters and information to be encrypted; a generating module, configured to generate system parameters according to the security parameters, wherein the system parameters include: a first hash function, a second hash function, a first generator, and a second generator; The generating module is further configured to generate a public-private key pair set according to the system parameter; wherein the public-private key pair set includes a public-private key pair, and the public-private key pair includes a public key and a private key matching the public key; A determination module, configured to determine a signature conforming to a preset structure according to the information to be encrypted, the system parameters and the set of public-private key pairs; wherein the preset structure includes a first label, a signature element, a multi-power and an internal Product argument; the inner product argument is an inner product argument of a first vector, and the first vector includes a third label, a multi-power, a challenge, a first random sub-vector, and a second random sub-vector; The determining module is specifically used to calculate n hash public keys through n first hash functions, and the formula (1) used is as follows: h _i =H _G (pk _i ) (1) In formula (1), hi represents the _ith public key hash, H _G represents the first hash function, pk _i represents the ith public key, and ski represents the private key corresponding to the _ith public key pk _i ; The first label t is calculated according to the hash public key and private key, and the formula (2) used is as follows:

In formula (2), t represents the first tag, h _j represents the jth hash public key, and sk _j represents the private key corresponding to the jth public key pk _j ; The second label is generated according to the second hash function, n public keys, the first label t and the message to be encrypted, and the formula (3) used is as follows: d=H _Z (pk ₁ ,pk ₂ ,...,pk _n ,t,m) (3) In formula (3), pk _i represents the ith public key, t represents the first tag, m represents the message to be encrypted, H _Z represents the second hash function, and d represents the second tag; According to the hash public key, the first tag, the second hash function, the system parameters and the public key to generate the commitment, the formula (4) used is as follows:

In formula (4), L represents commitment, g represents the first generator in the system parameters, d represents the second label, t represents the first label, α represents a random number, p _i represents the _ith public key, and hi represents The i-th hash public key, c _i represents the i-th random number; The challenge is generated according to the second label and commitment, and the utilized formula (5) is as follows: c′=H _Z (L,d) (5) In formula (5), c′ represents the challenge, L represents the commitment, d represents the second label, and H _Z represents the second hash function; To generate the first random sub-vector, the formula (6) used is as follows: C=(c ₁ ,c ₂ ,...,c _j-1 ,c _j ,c _j+1 ,...,c _n ) (6) In formula (6), C represents the first random sub-vector,

c ₁ ,c ₂ ,...,c _j-1 ,c _j+1 ,...,c _n represent n-1 random numbers respectively; To calculate the signature element, the formula (7) used is as follows: r=α-c _j sk _j (7) In formula (7), r represents the signature element, α represents a random number,

c ₁ ,c ₂ ,...,c _j-1 ,c _j+1 ,...,c _n represent n-1 random numbers respectively, and sk _j represents the jth private key; To calculate multiple powers, the formula (8) used is as follows:

In formula (8), P represents multiple powers, g represents the first generator in the system parameters, d represents the second label, t represents the first label, r represents the signature element, and L represents the commitment; To generate the second random sub-vector, the formula (9) used is as follows: E=(1,1,...1) (9) In formula (9), E is the second random sub-vector; To calculate the first vector, the formula (10) used is as follows: W=(pk _i ^d h _i ,P,c′,C,E) (10) In formula (10), W is the first vector, p _i ^d h _i is the third label, C is the first random sub-vector, E is the second random sub-vector, p _i is the ith public key, and d is the second label; Calculate the inner product argument π of the first vector; output signature σ=(t,r,P,π); Among them, t represents the first label, r represents the signature element, P represents the multiple power, and π represents the inner product argument of the first vector W, the size of the argument is 2log ₂ n+1, and the size of the signature is 2log ₂ n +4. 3. An electronic device, comprising: at least one processor and a memory; wherein, the memory stores computer-executed instructions; The at least one processor executes computer-executable instructions stored in the memory to cause the at least one processor to perform the connectable ring signature method of claim 1 . 4. A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when a processor executes the computer-executable instructions, the connectable ring according to claim 1 is implemented. signature method.

Images