CN113972987B - A method of identity-based multi-signature based on subgroup - Google Patents

Abstract

The present invention proposes an identity-based multi-signature method based on subgroups. First, the group administrator uses the group private key to generate the corresponding member private key for the group members in the signer group, and calculates secondly, after the signature subgroup is selected, the members contained in the subgroup will sign the same message on behalf of the entire group; when all members in the subgroup complete the signature, the member signature will be sent to the group administrator, The group administrator will decide whether to aggregate into a multi-signature after verifying the correctness of the received signatures. If all member signatures are legal, then aggregate, otherwise the signature will fail. After the multi-signature is generated, any entity can verify its validity. The invention can simplify the authentication process in the multi-signature aggregation process, improve the robustness of the multi-signature in the application confrontation scene of the consensus mechanism, and enhance the security in practical application.

Description

A method of identity-based multi-signature based on subgroup

technical field

The invention proposes an identity-based multi-signature method based on subgroups, which belongs to the field of information security.

Background technique

With the vigorous development of computer information technology and the continuous in-depth application of e-commerce and blockchain, digital signatures are widely used in the application scenarios of electronic wallets and consensus mechanisms. In blockchain and other related fields, the construction efficiency of secure electronic ledgers is closely related to the efficiency of signature verification and economic benefits. At the same time, the decentralized anonymous consensus mechanism also raises the need to resist malicious forgery of message signatures. In order to ensure the security of electronic transactions, improved multiple digital signatures play an increasingly important role in signature entity verification, transaction integrity, etc.

However, in practical applications, the scheme based on the public key infrastructure needs to spend additional resources for certificate management. For example, setting up a public certificate server to issue a revocation certificate is relatively complicated and cumbersome in application. The relevant storage space will be reduced and the verification efficiency will be improved. At the same time, in the traditional multi-signature scheme, the entities participating in the signature are honest by default, which makes it difficult for the traditional scheme to guarantee the validity of the signature in the actual situation in the application scenario of countering forged signatures. In order to enhance the robustness of multi-signature, the scheme should add a step of verifying the signing entity before generating the aggregate signature.

In response to the above problems, in order to enhance the efficiency of electronic transactions and ensure the security of electronic assets, multiple digital signatures should be combined with identity digital signatures to simplify the entity authentication process, select random signature subgroups to represent the entire group to generate multiple signatures, and increase the number of signatures before aggregation. Verification to improve the robustness of multi-signature.

Contents of the invention

Purpose of the invention: In order to solve the difficulty of guaranteeing due security in the confrontational application scenarios of traditional solutions and simplify the identity authentication process of signature group members, this invention proposes an identity-based multi-signature method based on sub-groups, which improves security and Authentication efficiency.

Technical solution: In order to achieve the above object, the technical solution adopted in the present invention is:

An identity-based multi-signature method based on subgroups, as shown in Figure 1, includes the following steps:

Step 1: Initialize the system parameters, and the group administrator generates the public-private key pair;

Step 2: The group members send their identities to the group administrator, and the group administrator generates private keys for the group members in turn;

Step 3: The group administrator calculates the group label according to the group member public key set, and the group member public key set and the group label are combined to form the group public key;

Step 4: The group administrator selects the signature sub-group and discloses the sub-group collection, and each member in the sub-group generates a signature and sends it to the group administrator;

Step 5: The group administrator verifies that the signature sent by the key member of the subgroup described in Step 4 is received, and if there is an illegal signature, return to Step 3;

Step 6: If all the signatures received by the group administrator in step 5 are legal, the group administrator aggregates member signatures into multiple signatures;

Step 7: Any entity inside or outside the group verifies the correctness of the multi-signature.

Further, step 1 is specifically:

Step 1.1, let G ₁ be the additive cyclic group whose order is prime number q, and G ₂ be the multiplicative cyclic group whose order is prime number q. Given a security parameter n, let Gen be the parameter generation algorithm; generate (q, g, G ₁ , G ₂ ) through Gen(n), where (G ₁ , G ₂ ) is a bilinear group pair of prime order q, The bilinear mapping is e: G ₁ ×G ₁ →G ₂ , which means the mapping from G ₁ to G ₂ , g is a generator of G ₁ , and the four secure hash functions are: H ₁ : {0, 1 } ^* → G ₁ , H ₃ : {0, 1} ^* → G ₁ , /> where Z _q denotes the set {0, 1, 2...q-1}, and /> Indicates the set {1, 2...q-1}, H ₁ : {0, 1} ^* → G ₁ means that a value belonging to the range of {0, 1} ^* gets a value belonging to the range of group G ₁ after passing through H ₁ The value in the system parameter is open to all group members;

Step 1.2, the group administrator randomly selects one as the master private key, and calculate the master public key y=g ^x .

Further, step 2 is specifically:

Step 2.1, each group member sends its ID _i to the group administrator PKG;

In step 2.2, the group administrator PKG calculates the hash value of pk _i =H ₁ (ID _i ), then calculates d _IDi =pk _i ^x and returns it to the corresponding group member.

Further, step 3 is specifically:

Step 3.1, the group administrator creates a set ID _G , adds the identities of all group members to the set, and maintains a list of public keys corresponding to the identity set ID _G

Step 3.2, the group administrator performs hash processing on the public key set ID _G to obtain gtag=H ₄ (ID _G ), where gtag is the calculated hash value and becomes the identification tag of the group;

In step 3.3, the public key set is combined with the group tag gtag to obtain the group public key gpk=(gtag, ID _G ), and the group public key is disclosed to the group members.

Further, step 4 is specifically:

Step 4.1, before signing the message m, the group administrator determines a member subset J, including the IDs of the members participating in the signature on behalf of the entire group, and discloses J's information in the group;

Step 4.2, the members whose IDs are in the subset J sign the message m respectively, and first select random numbers respectively

In step 4.3, the members participating in the signature perform hash processing on gtag and m to obtain H ₃ (gtag, m), and then calculate with /> Where gtag is the group tag value, m is the message to be signed, r _j is the random number selected by each member, d _IDj is the private key of each member, and g is the generator of group _G1 ;

Step 4.4, the signature generated by each group member participating in the signature consists of 2 parts, namely the signature value After the signature S _j is generated, the group members send the signature S _j to the group administrator PKG.

Further, step 5 is specifically:

Step 5.1, the group administrator verifies the received member signatures, performs hash processing on gtag and m, and obtains H ₃ (gtag, m), and then calculates three bilinear pairings e(y, pk _j ) and /> the value of where /> with /> is a component of member signature S _j , y is the public key of the group administrator (j ∈ (0, 1, 2...n), n is the number of members in J);

Step 5.2, compare with /> Whether the values of the two are equal, if they are equal, the member signature S _j is a valid signature, otherwise it is an illegal signature;

In step 5.3, when an illegal member signature occurs, return to step 3.1 to re-determine the signature subgroup.

Further, step 6 is specifically:

Step 6.1, if all member signature verifications are valid signatures, the group administrator PKG aggregates the received member signatures;

Step 6.2, perform hash processing on (ID _j , J, ID _G ), and obtain the hash value a _j = H ₂ (ID _j , J, ID _G ) (j∈(0, 1, 2...n), n is J number of members in);

Step 6.3, calculate with />

In step 6.4, the aggregated multi-signature consists of two parts, namely σ=(σ ₁ , σ ₂ ).

Further, step 7 is specifically:

Step 7.1, when verifying the correctness of the multi-signature, first perform hash processing on (ID _j , J , ID _G ), and obtain the hash value a _j = H ₃ (ID _j , J , ID _G ) (j∈(0, 1 , 2...n), n is the number of members in J), and then calculate the aggregated public key

Step 7.2, perform hash processing on gtag and m to obtain H ₃ (gtag, m), and then calculate three bilinear pairs e(g, σ ₁ ), e(y, apk) and e(σ ₂ , H ₃ (gtag, m)), where σ ₁ and σ ₂ are the components of the multi-signature σ, and y is the public key of the group administrator;

Step 7.3, compare whether the values of e(g, σ ₁ ) and e(y, apk)·e(σ ₂ , H ₃ (gtag, m)) are equal, if they are equal, the multi-signature σ=(σ ₁ , σ ₂ ) is a valid signature, otherwise it is an illegal signature.

Beneficial effects: the present invention provides an identity-based multi-signature method based on sub-groups. The multiple digital signatures adopted are combined with identity digital signatures to simplify the entity authentication process. By selecting random signature sub-groups to represent the entire group, multiple signatures are generated and signatures are added. The verification before aggregation improves the robustness of multi-signatures, thereby enhancing the efficiency of electronic transactions and ensuring the security of electronic assets.

Description of drawings

Fig. 1 is a schematic flow chart of the algorithm of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with specific examples, but the present invention is not limited thereto.

The subgroup-based identity-based multi-signature method proposed by the present invention includes the following three stages: a key preparation stage, a signature generation stage and a signature verification stage. This implementation includes three entities: group administrators, group members and verifiers.

Group administrator: set system parameters; generate private keys for group members, calculate group labels and group public keys, and determine the subset of members who generate multiple signatures each time. All signatures are legal, and member signatures are aggregated into multi-signatures.

Group members: each sign their own signature; send the public key ID _i to the group administrator to obtain their own private key, judge whether to participate in the signature according to the subgroup set determined by the group administrator, and if they participate, use the private key to generate a signature and send it to the group administrator.

Verifier: verify the signature; the verifier can be any entity inside or outside the group. After calculating the aggregated public key apk, the verifier can calculate the relevant bilinear pairing value to verify the validity of the multi-signature.

An identity-based multi-signature method based on subgrouping. Let G ₁ be an additive cyclic group whose order is a prime number q, its generator is g∈G ₁ , and G ₂ is a multiplicative cyclic group whose order is a prime number q. Set the security parameter n=|q|, and the bilinear mapping is e: G ₁ ×G ₁ →G ₂ , representing the mapping from G ₁ to G ₂ . Suppose H ₁ and H ₃ are two cryptographic hash functions that map {0, 1} ^* to G ₁ , and H ₂ and H ₄ are two cryptographic hash functions that map {0, 1} ^* to hash function, the public system parameter set is Params={q, g, G ₁ , G ₂ , e, H ₁ , H ₂ , H ₃ , H ₄ }. Let the group member set U={u ₁ , u ₂ ...u _n }, where n is the number of group members, n≥2, and the corresponding identity list is ID _G ={ID ₁ , ID ₂ ...ID _n }, maintained by the group administrator. To co-sign a message m={0,1} ^* , the following stages are involved:

(1) Key preparation stage:

①Administrator selection As the system master private key, calculate the corresponding master public key y=g ^x .

②The group members send the identity ID _i to the administrator, and the group administrator calculates the hash value of pk _i ＝H ₁ (ID _i ), and then calculates d _IDi ＝pk _i ^x to generate private keys for the group members in turn and send them to each group member .

③ The group administrator calculates the group tag gtag=H ₄ (ID _G ) corresponding to the current group member identity list ID _G , and discloses the group public key gpk=(gtag, ID _G ) to the group members, wherein the hash algorithm H ₄ uses SHA- 256 algorithm.

(2) Signature generation stage:

① In order to sign the message m={0, 1} ^* on behalf of the entire group, the group administrator first uses a pseudo-random algorithm to determine the subgroups participating in the signature. In this embodiment, the subgroup size is set as That is, the member subset J contains /> The identity ID _i of each group member, the group members participating in the signature each time are randomly selected, and the information of the member subset J is made public in the group.

②After receiving the member subset J, the group members judge whether they participate in the signature. Participating signers first calculate the hash value H ₃ (gtag, m), and then calculate with /> Where gtag is the group tag value, m is the message to be signed, /> is the random number selected by each member, d _IDj is the private key of each member, and g is the generator of group _G1 . After the signature is generated, the group members will sign /> Sent to group admin.

③ Before the aggregation member signs, the signature needs to be verified. The aggregation signature does not involve secret parameters, and can be executed by any group member in the group. In this embodiment, the aggregation is selected by the group administrator. The group administrator first calculates H ₃ (gtag, m), and then calculates three bilinear pairings for each signature S _j e(y, pk _j ) and /> value, compare /> with e(y, pk _j )·> Whether the values of the two are equal, if they are equal, the member signature S _j is a valid signature, otherwise it is an illegal signature. If there is an illegal signature, exit the aggregation process, and the group administrator will re-determine the signature subgroup.

④ If all received signatures are legal, the group administrator aggregates member signatures into multiple signatures. First calculate the hash value a _j = H ₂ (ID _j , J , ID _G ), and then calculate with /> The final multi-signature σ=(σ ₁ , σ ₂ ) is obtained.

(3) Signature verification stage:

Any entity can verify the correctness of the multi-signature σ after obtaining the public parameter Params in the group, the group membership list ID _G and the signature member subset J. The verifier first calculates H ₃ (gtag, m), and then calculates a _j = H ₃ (ID _j , J, ID _G ) (j∈(0, 1, 2…n), n is the number of members in J), find Aggregated public key value. Finally, calculate the values of 3 bilinear pairs e(g, σ ₁ ), e(y, apk) and e(σ ₂ , H ₃ (gtag, m)), where σ ₁ and σ ₂ are multi-signature σ component, y is the public key of the group administrator. Finally, compare whether the values of e(g, σ ₁ ) and e(y, apk)·e(σ ₂ , H ₃ (gtag, m)) are equal. If they are equal, then the multi-signature σ=(σ ₁ , σ ₂ ) is a valid signature, otherwise it is an illegal signature.

Security Analysis

Theorem 1 (Correctness) This subgroup-based identity-based multi-signature approach is correct.

Proof: If the multi-signature is calculated according to the above signature algorithm, the following two types of equations must be established:

1) When the group is fixed and the group tag is gtag, the signature of each group member u _i participating in the signature on the message m The verification equation is satisfied:

2) Multi-signature σ=(σ ₁ , σ ₂ ) satisfies the verification equation:

Theorem 2 (Unforgeability) Under the random oracle model, if there is an attacker By forging a multi-signature with a non-negligible probability, an instance of solving the CDH problem can be obtained.

prove: is the attacker algorithm, /> Yes /> Another algorithm for the subroutine, /> is a CDH problem challenger. H ₁ , H ₂ , H ₃ , H ₄ are random oracles, /> Given (G ₁ , G ₂ , q, g, g ^α , g ^β ), where /> are all cyclic groups of order prime q, /> challenger/> The goal is to exploit the extended bifurcation lemma, running the algorithm /> To solve the CDH problem, that is to calculate g ^αβ .

Will use Algorithm B as a subroutine, set y=g ^α as the challenge master public key, then α is the system master private key. B sets the challenge identity ID ^* , and B needs to answer /> The signature and Hash query of the challenge identity ID ^* The corresponding public key obtained in the query is called the challenge public key pk ^★ . Select system parameters Params={G ₁ , G ₂ , e, q, g, y, H ₁ , H ₂ , H ₃ , H ₄ }, send system parameters to /> The following definition B answers /> Asked rules:

①B answer For inquiries about _H2 refer to random vectors />

② Answer H ₁ : B keeps a list Initially as /> Query the Hash value corresponding to z, if Then output c as the answer; otherwise, first determine the random value x∈{0, 1}, and then choose the random number /> If x=0, set h=g ^c , if x=1, then set h=g ^βc , update each answer />

③ Answer the Extract query: When asking for the private key corresponding to y, first call the H ₁ oracle machine to view /> (z, c, x, h) in . If x=0, namely h=g ^c , return d _ID =y ^c as the private key; if x=1, h=g ^αc , return ⊥.

④ Answer H ₂ : B keeps a list Initially as /> Query the hash value corresponding to z for the ith time, if Then output c as the answer; otherwise, decide how to respond according to the content of z /> If z=(ID, J, ID _G ) and ID ^★ ∈ J, when ID=ID ^★ , answer H ₂ (ID, J, ID _G ) = c _i ; otherwise answer H ₂ (ID _j , J, ID _G )=d _j , where /> If it does not belong to the above situation, choose a random number /> as an answer. Update list after each answer />

⑤ Answer H ₃ : B maintains a list Initially as /> Query the hash value corresponding to z, if Then output h as the answer; otherwise choose a random number /> Compute H=g ^λ as the answer; also update the list after each answer />

⑥ Answer H ₄ : B keeps a list Initially as /> Query the hash value corresponding to z, if Then output h as the answer; otherwise choose a random number /> as an answer; also update the list after each answer

⑦ Answer Sign( , sk ^★ , pk ^★ , ): When A inquires about the signature corresponding to z, first call H ₃ oracle machine to check (z, λ, h) in . if /> return /> ; otherwise decide how to respond according to the content of z /> If z=(ID, gtag, m) and ID ^★ ∈ J, when ID = ID ^★ , return ⊥; otherwise look up the list /> Obtain the public key h corresponding to the ID, select a random number /> , return U=y ^δ , V=y ^β , that is, S=(U, V) as the signature, and then calculate (g ^β -h) ^-δ as H, let /> , and add (z,λ,H) to the list /> middle.

Ultimately, the forger It will return the signer set J={ID ₁ , ID ₂ ... ID _n } containing n group members, the group member identity set ID _G and the corresponding public key set/> The forged signature σ ^★ and the corresponding message m ^★ and group public key gpk=(gtag ^★ , ID _G ). counterfeiter /> The signature of (m ^★ , gtag ^★ ) cannot be directly interrogated, while the forged signature (J, σ ^★ ) can be verified as valid.

If list Algorithm B is terminated if x=0 corresponding to the challenge identity ID ^* . Since x is chosen at random, the probability that B does not terminate is 1/2. Let k be ^pk at /> The subscript in, that is, pk ^★ ＝pk _k ; j _f is the subscript of H ₂ (ID ^* , J, ID _G ) in f, that is /> a _j =H ₂ (ID _j , J, ID _G ). Therefore, the final output of B is expressed as ({j _f }, {(σ ^★ , ID _G , J, apk, {a _j } _j∈J )}), and the probability of B's successful output is ∈/2.

challenger run the algorithm /> To solve the CDH problem, according to the generalized bifurcation lemma algorithm settings, run The output of is ({j _f }, {out}, {out′}). Run /> twice before and after The random vectors f and f′ used are different, but still satisfy the /> In the output result, out=(σ, ID _G , J, apk, {a _j } _j∈J ) and out′=(σ′, ID _G ′, J′, apk′, {a′ _j } _j∈J′ ). Specifically, σ=(σ ₁ , σ ₂ ) and σ′=(σ ₁ ′, σ ₂ ′).

run twice before and after The fork is set to /> with /> That is, a _k ≠ a′ _k . And the group of signers is fixed, that is, ID _G =ID _G ' and J=J'. Therefore, other j∈J except a _k satisfies a _j = a′ _j , according to /> Available

algorithm The output signatures σ and σ′ are legal signatures, so the following verification equations hold:

e(g, σ ₁ ) = e(y, apk) · e(σ ₂ , H ₃ (gtag, m))

e(g, σ ₁ ′)=e(y, apk′) e(σ ₂ ′, H ₃ (gtag, m))

According to the properties of symmetric bilinear maps, there are:

Right now

Ultimately, the challenger Based on this, the solution to the difficult CDH problem can be successfully calculated, namely:

While the CDH problem is difficult in polynomial time, it contradicts the reasoning result, so the assumed falsifier in the proof No, the subgroup-based identity-based multi-signature method is unforgeable.

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (7)

1. An identity-based multiple signature method based on sub-packets is characterized in that: the method comprises the following steps:

step 1: initializing system parameters, and generating a main public-private key pair by a group administrator;

step 2: the group member sends the identity to a group manager, and the group manager sequentially generates a private key for the group member;

step 3: the group administrator calculates a group tag according to the group member public key set, and the group member public key set and the group tag are combined to form a group public key;

step 4: the group administrator selects signature sub-groups and discloses a sub-group set, and members in the sub-groups respectively generate signatures and send the signatures to the group administrator;

step 5: the group administrator verifies and receives the signature sent by the sub-group key member in the step 4, and if the signature is illegal, the step 3 is returned to;

step 6: if all the signatures received by the group administrator in the step 5 are legal, the group administrator aggregates the member signatures into multiple signatures;

step 7: any entity inside and outside the group verifies the correctness of the multiple signatures;

the step 3 is specifically as follows:

step 3.1, group Administrator creates set ID _G Adding the identities of all group members to the set and maintaining a set ID with the identities _G Corresponding public key list

Step 3.2, group administrator vs. public Key set ID _G Hash processing is performed to obtain gtag=h ₄ (ID _G ) Gtag is the calculated hash value and becomes the identification tag of the group;

step 3.3, combining the identity set with the group tag gtag to obtain a group public key gpk= (gtag, ID) _G ) The group public key is disclosed to the group members.

2. The sub-packet-based identity-based multi-signature method as claimed in claim 1, wherein step 1 is specifically:

step 1.1, set G ₁ For addition cyclic groups of order prime q, G ₂ A multiplication cyclic group with the order of prime number q; setting a safety parameter n, and setting Gen as a parameter generation algorithm; by Gen (n) generation of (q, G, G ₁ ，G ₂ ) Wherein (G) ₁ ，G ₂ ) Bilinear group pairs for prime order q, bilinear map as e: g ₁ ×G ₁ →G ₂ Represents the slave G ₁ To G ₂ G is G ₁ 4 secure hash functions are: h ₁ ：{0，1} ^* →G ₁ ，H ₃ ：{0，1} ^* →G ₁ ，/>Wherein Z is _q The expression set {0,1, 2..q-1 }, and +.>The representation set {1, 2..q-1 }, H ₁ ：{0，1} ^* →G ₁ Represents a component belonging to {0,1} ^* Values within the range pass through H ₁ Then a group G is obtained ₁ Values within the range, system parameters are disclosed to all group members;

step 1.2, the group administrator randomly selects oneAs the primary private key, and computes the primary public key y=g ^x 。

3. The sub-packet-based identity-based multi-signature method of claim 1, wherein step 2 is specifically:

step 2.1, each group member will have its own identity ID _i To a group administrator PKG;

step 2.2, group administrator PKG computes pk _i ＝H ₁ (ID _i ) Is calculated again by the hash value of d _IDi ＝pk _i ^x And returning to the corresponding group member.

4. The sub-packet-based identity-based multi-signature method as claimed in claim 1, wherein step 4 is specifically:

step 4.1, before signing the message m, the group administrator determines a member subset J, including the identity IDs of members representing the entire group participating in the signature, and discloses the information of J in the group;

step 4.2, the members of the ID in the subset J sign the message m respectively, and the random numbers are selected respectively first

Step 4.3, the member participating in the signature performs hash processing on the gtag and the m to obtain H ₃ (gtag, m), next calculateAnd->Where gtag is the group tag value, m is the message that needs to be signed, r _j Is the random number selected by each member, d _IDj Is the private key of each member, G is group G ₁ Is a generator of (1);

step 4.4, the signature generated by each group member participating in the signature is composed of 2 parts, i.e. signature value Generating a signature S _j Post group member will sign S _j To the group administrator PKG.

5. The sub-packet-based identity-based multi-signature method as claimed in claim 1, wherein step 5 is specifically:

step 5.1, the group administrator verifies the received member signature, and performs hash processing on gtag and m to obtain H ₃ (gtag, m), next calculate 3 bilinear pairingsAnd->Wherein>And->Is a member signature S _j Y is the public key of the group administrator (J e (0, 1,2 … n), n is the number of members in J);

step 5.2, compareAnd->Whether the values of the two are equal, if so, the member signature S _j If the signature is valid, otherwise, the signature is illegal;

and 5.3, when illegal member signature appears, returning to the step 3.1 at the moment, and re-determining the signature sub-packet.

6. The sub-packet-based identity-based multi-signature method of claim 1, wherein step 6 is specifically:

step 6.1, if all member signature verification is valid signature, the group administrator PKG aggregates the received member signature;

step 6.2, pair (ID _j ,J，ID _G ) Performing hash processing to obtain a hash value a _j ＝H ₂ (ID _j ，J，ID _G ) (J E (0, 1,2 … n), n is the number of members in J);

step 6.3, calculatingAnd->

Step 6.4, the aggregated multiple signature consists of 2 parts, i.e. σ= (σ) ₁ ，σ ₂ )。

7. The sub-packet-based identity-based multi-signature method as claimed in claim 1, wherein step 7 is specifically:

step 7.1, checkingWhen the correctness of the multiple signatures is verified, the method comprises the steps of first checking (ID _j ，J，ID _G ) Performing hash processing to obtain a hash value a _j ＝H ₂ (ID _j ，J，ID _G ) (J E (0, 1,2 … n), n is the number of members in J), and then compute the aggregated public key

Step 7.2, performing hash processing on gtag and m to obtain H ₃ (gtag, m), next 3 bilinear pairings e (g, σ) are calculated ₁ ) E (y, apk) and e (sigma) ₂ ，H ₃ (gtag, m)), wherein σ ₁ And sigma (sigma) ₂ Is an integral part of the multiple signature sigma, y is the public key of the group administrator;

step 7.3, compare e (g, σ) ₁ ) And e (y, apk) e (sigma) ₂ ，H ₃ (gtag, m)) and if they are equal, the multiple signature σ= (σ) ₁ ，σ ₂ ) And if the signature is valid, otherwise, the signature is illegal.