CN107846281B - Location-based proxy multi-signature method and system - Google Patents

Abstract

The present invention provides a location-based proxy multi-signature method and system. The method includes: initializing the proxy signer PS, the original signer group OSG and the location infrastructure PI; completing the original signer group OSG with the participation of the PI The authenticity of the location is verified, and then the PI is used to verify the authenticity of the location of the proxy signer PS, and finally the original signer group OSG completes the proxy signature authorization for the designated location of the proxy signer PS; the proxy signer PS is in the PI's It completes the authentication function of its own location under the support, and then performs the proxy signature function for specific information; the proxy signature verifier V completes the verification that the proxy signature is indeed authorized by the original signer group at the specified location. The preset information is proxy signed. The method in the present invention has high security and wide application range, and realizes the transfer of authentication power of identity and location.

Description

Location-based proxy multi-signature method and system

technical field

The present invention relates to the technical field of network information security, in particular to a location-based proxy multi-signature method and system.

Background technique

In recent years, location-based related services and applications and proxy signature technology have been deeply researched and developed. Location-based services and applications can perform positioning for the user's location, and can also provide users with location-related services, such as hotel services, catering services, postal services, and travel services. Proxy signature technology provides the ability of one user to authorize another user to implement proxy signature, thereby realizing the function of authenticating the integrity, non-repudiation and origin of the message.

However, the prior art is still unable to realize the function of authorizing a single user in another location to perform proxy signature at a designated location on behalf of the user group by a combination of user groups located in different locations in a mobile Internet environment. Therefore, user location security and location-related message integrity, authentication, and non-repudiation cannot be guaranteed.

SUMMARY OF THE INVENTION

In view of the defects in the prior art, the purpose of the present invention is to provide a location-based proxy multi-signature method and system.

In a first aspect, the present invention provides a location-based proxy multi-signature method, including:

The location-based implementation PI obtains the security parameter 1 ^k , the master key mk, and the public parameter pp during the initialization process, and sends unique corresponding identity information to each original signer OS in the original signer group OSG; The signer group OSG contains n original signers OS, and the i-th original signer is denoted as OS _i , where i=1, 2, 3,...,n; the identity corresponding to the i-th original signer OS _i The information is ID _i , and n represents the total number of original signers;

Receive the proxy signature request information sent from the original signer OS _i , where the proxy signature request information includes the location information corresponding to the original signer OS _i

为有效信息时，向每一个原始签名者OS_i发送对应的确认信息；并生成代理授权密钥包

i＝1,2,3,…,n；

表示第i个原始签名者对应的代理授权密钥包；Determine the location information corresponding to each original signer OS _i through the location location protocol

When it is valid information, send corresponding confirmation information to each original signer OS _i ; and generate proxy authorization key package

i=1,2,3,...,n;

Indicates the proxy authorization key package corresponding to the i-th original signer;

Send the corresponding proxy authorization key package to each original signer

Receive the proxy authorization certificate dw sent by the checker side, and the dw contains the identities, locations, signable message types, and validity period information of all original signers and proxy signers;

The proxy signature key package pskp is generated according to the proxy authorization certificate dw, and sent to the proxy signer PS.

Optionally, the proxy authorization key package is encapsulated with a location location protocol, an authorization key, the identity information of the corresponding original signer, the identity information of the proxy signer, the location information of the corresponding original signer, and the location of the proxy signer. information;

The proxy signature key package pskp encapsulates a location location protocol, a proxy signature key, the identity information of the proxy signer, the location information of the proxy signer, and a signature algorithm.

Optionally, the location positioning protocol includes: a global positioning system GPS protocol, which is used to determine the location of the original signer and the proxy signer.

In a second aspect, the present invention provides a location-based proxy multi-signature method, comprising:

其中，OS_i表示第i个原始签名者，

表示第i个原始签名者对应的位置信息，其中i＝1,2,3,…,n，n表示原始签名者的总数；The original signer OS _i sends proxy signature request information to the location infrastructure PI, where the proxy signature request information includes the location information corresponding to the original signer OS _i

where OS _i represents the i-th original signer,

Represents the location information corresponding to the i-th original signer, where i=1, 2, 3,..., n, n represents the total number of original signers;

i＝1,2,3,…,n；

表示第i个原始签名者对应的代理授权密钥包：The original signer OS _i receives the agent authorization key package sent by the location base implementation PI

i=1,2,3,...,n;

Indicates the proxy authorization key package corresponding to the i-th original signer:

确定原始签名者OS_i的位置有效时，生成相应的代理授权信息；所述代理授权信息中包含有原始签名者的身份信息、原始签名者的位置信息以及根据所述代理授权密钥包生成的签名dw_i，dw_i表示第i个代理授权密钥包

生成的签名；Authorize keybags according to the agent

When it is determined that the location of the original signer OS _i is valid, the corresponding proxy authorization information is generated; the proxy authorization information includes the identity information of the original signer, the location information of the original signer, and the information generated according to the proxy authorization key package. Signature dw _i , dw _i represents the ith agent authorization key package

generated signature;

The proxy authorization information is sent to a checker, wherein the checker is any one of the original signers specified in the original signer group OSG.

Optionally, the proxy authorization key package is encapsulated with a location location protocol, an authorization key, the identity information of the corresponding original signer, the identity information of the proxy signer, the location information of the corresponding original signer, and the location information of the proxy signer;

Optionally, when the original signer is the checker, also include:

生成的签名dw_i是否由原始签名者OS_i来生成，Determine any original signer specified in the original signer group OSG as a checker, and the checker checks the agent authorization key package

Whether the generated signature _{dwi is generated by the original signer OS i ,}

If not, it is invalid, and the process ends;

if,

dw表示代理授权证书，dw中包含有所有原始签名者和代理签名者的身份信息、位置信息、可签名消息类型信息、有效期信息；Then dwi _i is valid, judge whether all dwi _i are valid, i=1, 2, 3,..., n, if all are valid, generate an agency authorization certificate, let

dw represents the proxy authorization certificate, and dw contains the identity information, location information, signable message type information, and validity period information of all original signers and proxy signers;

A proxy authorization certificate is sent to the proxy signer PS.

In a third aspect, the present invention provides a location-based proxy multi-signature method, comprising:

Receive the proxy signature key package pskp sent by the location infrastructure PI and the proxy authorization certificate sent by the inspector;

Determine whether the location information Pos _PS of the proxy signer PS itself is valid according to the location positioning protocol encapsulated in the proxy signature key package pskp, and if it is invalid, end the process;

If valid,

Then send a multi-signature to the signature verifier V, the multi-signature is recorded as: (m,s,dw,pp), (m,s,dw,pp) represents the signature s for the message m, and the number of times the signature s is valid is 1 time;

The validity of the location information Pos _PS means that the location information of the proxy signer PS is consistent with the location information about the proxy signer PS in the proxy authorization certificate.

In a fourth aspect, the present invention provides a location-based proxy multi-signature method, comprising:

Receive the proxy multi-signature (m, s, dw, pp) sent by the proxy signer PS; where (m, s, dw, pp) represents the signature s for the message m, and the number of times the signature s is valid is 1;

Check whether the proxy authorization certificate is valid through the identity information and location information of the original signer, the identity information and location information of the proxy signer, and the public parameter pp. If it is invalid, the process ends;

If it is valid, the preset multi-signature verification algorithm is used to verify whether s is the proxy multi-signature of message m. If the verification is successful, it is confirmed that the message m is indeed represented by the proxy signer at the specified position Pos _PS on behalf of the original signer group.

In a fifth aspect, the present invention provides a location-based proxy multi-signature system, including: a location infrastructure PI, an original signer OS, a proxy signer PS, and a signature verifier V; wherein,

the location infrastructure PI for performing the location-based proxy multi-signature method of any one of the first aspects of the claim;

The original signer OS is configured to execute the location-based proxy multi-signature method of any one of the second aspects of the claim;

The proxy signer PS is used to perform the location-based proxy multi-signature method described in the third aspect of claim;

The signature verifier V is used to execute the location-based proxy multi-signature method of the fourth aspect of the claim.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention provides a function of enabling multiple users in different positions to authorize users in a designated position to sign on behalf of multiple users, and ensures the integrity and non-repudiation of the location-based message, so that the location-related information is more Safe and reliable. Further, in an optional solution, the location-based proxy multi-signature method provided by the present invention also verifies the signed message issued by the proxy signer, and does not limit the location of the proxy signature verifier, further ensuring the reliability of the signed message. sex and safety.

Description of drawings

Other features, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments with reference to the following drawings:

1 is a schematic diagram of an application scenario of the method in the present invention;

2 is a flowchart of a location-based proxy multi-signature method provided by an embodiment of the present invention;

3 is a schematic flowchart of an agent authorization key package in an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a proxy signing key package in an embodiment of the present invention.

Detailed ways

The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the inventive concept. These all belong to the protection scope of the present invention.

The system applying the location-based proxy multi-signature method provided by the present invention includes: a location infrastructure (Position Infrastructure, PI), an original signer (Original Signer, OS), a proxy signer (ProxySigner, PS) and a signature verifier (Verifier) , V); wherein, all original signers constitute the original signer group (Original Signer Group, OSG). As shown in FIG. 1 , the original signer group OSG jointly authorizes the proxy signer PS, with the assistance of the location infrastructure PI, to complete the proxy signer capability for specific information for the proxy signer PS at the specified location.

As shown in FIG. 2 , the location-based proxy multi-signature method provided by the present invention may include: the first step: initializing the proxy signer PS, the original signer group OSG and the location infrastructure PI; the second step: first With the participation of PI, the authenticity verification of the location of the original signer group OSG is completed, then PI verifies the authenticity of the location of the proxy signer PS, and finally the original signer group OSG completes the proxy signer PS's designated location proxy Signature authorization; Step 3: First, the proxy signer PS must complete the authentication function of its own location with the support of PI, and then perform the proxy signature function for specific information; Step 4: The proxy signature verifier V completes the verification The proxy signature is indeed authorized by the original signer group at the specified location to jointly authorize the proxy signer at the specified location to perform proxy signature on the preset information.

Further, as shown in FIG. 3 , the original signer OS (original signer group OSG) first judges whether the corresponding original signer OS is in the specified position with the assistance of PI, and if so, generates a proxy authorization key; if not, Finish. The proxy authorization key is used as the input of the proxy authorization generation module, and combined with the authorization certificate information, the proxy authorization certificate is generated and sent to the proxy signer PS.

Further, as shown in FIG. 4 , the proxy signer PS firstly judges whether it is in the designated position with the assistance of PI, and if so, generates the proxy signing key, and if not, it ends. The proxy signature key is used as the input for proxy signature generation, and the message to be signed is added to generate proxy signature, which is sent to proxy signature verifier V.

The location-based proxy multi-signature method provided by the present invention can realize the function of multiple users at different locations authorize the users at the specified location to sign on behalf of multiple users, and ensure the integrity and non-repudiation of the location-based message , making location-related information more secure and reliable.

Optionally, the location-based proxy multi-signature method provided by the present invention also verifies the signed message issued by the proxy signer, and does not limit the location of the proxy signature verifier, further ensuring the reliability and security of the signed message.

The method of the present invention is different from the traditional method based on identity verification, and realizes the transfer of authentication rights based on identity and location, and satisfies the security of multiple user groups in different locations arbitrarily designated to authorize the implementation of proxy signatures under the mobile Internet environment. sexual requirements.

In order to describe the method in the present invention more clearly, detailed description is given below with reference to specific embodiments. Specifically, the location-based setting on the PI side includes the following steps:

Step A1: The location infrastructure PI obtains the security parameter 1 ^k , the master key mk, and the public parameter pp in the initialization process, and sends the unique corresponding identity information to each original signer OS in the original signer group OSG respectively; wherein , assuming that the original signer group OSG contains n original signers OS, the i-th original signer is recorded as OS _i , where i=1,2,3,...,n; then the i-th original signer OS _i The corresponding identity information is ID _i ;

Step A2: Receive the proxy signature request information sent from the original signer OS _i , where the proxy signature request information includes the location information corresponding to the original signer OS _i

为有效信息时，向每一个原始签名者OS_i发送对应的确认信息；并生成代理授权密钥包

i＝1,2,3,…,n；

表示第i个原始签名者对应的代理授权密钥包；其中，所述代理授权密钥包中封装有位置定位协议、授权密钥、对应原始签名者的身份信息、代理签名者的身份信息、对应原始签名者的位置信息以及代理签名者的位置信息；Step A3: Determine the location information corresponding to each original signer OS _i through the location location protocol

When it is valid information, send corresponding confirmation information to each original signer OS _i ; and generate proxy authorization key package

i=1,2,3,...,n;

Indicates the proxy authorization key package corresponding to the i-th original signer; wherein, the proxy authorization key package is encapsulated with a location positioning protocol, an authorization key, the identity information of the corresponding original signer, the identity information of the proxy signer, Corresponding to the location information of the original signer and the location information of the proxy signer;

Step A4: Send the corresponding proxy authorization key package to each original signer

Step A5: Receive the proxy authorization certificate dw sent by the checker side, and the dw contains the identities, locations, signable message types, and validity period information of all original signers and proxy signers;

Step A6: Generate a proxy signature key package pskp according to the proxy authorization certificate dw, and send it to the proxy signer PS, wherein the proxy signature key package pskp is encapsulated with a location location protocol, proxy signature key, proxy signature The identity information of the signer, the location information of the proxy signer, the signature algorithm, etc.

The OS side of the original signer (the OSG side of the original signer group) includes the following steps:

其中，OS_i表示第i个原始签名者，

表示第i个原始签名者对应的位置信息，其中i＝1,2,3,…,n，n表示原始签名者的总数；Step B1: the original signer OS _i sends proxy signature request information to the location infrastructure PI, where the proxy signature request information includes the location information corresponding to the original signer OS _i

where OS _i represents the i-th original signer,

Represents the location information corresponding to the i-th original signer, where i=1, 2, 3,..., n, n represents the total number of original signers;

i＝1,2,3,…,n；

表示第i个原始签名者对应的代理授权密钥包；其中，代理授权密钥包中封装有位置定位协议、授权密钥、对应原始签名者的身份信息、代理签名者的身份信息、对应原始签名者的位置信息以及代理签名者的位置信息；Step B2: The original signer OS _i receives the proxy authorization key package sent by the location infrastructure PI

i=1,2,3,...,n;

Indicates the proxy authorization key package corresponding to the i-th original signer; wherein, the proxy authorization key package contains the location location protocol, authorization key, identity information corresponding to the original signer, identity information of the proxy signer, corresponding original signer The location information of the signer and the location information of the proxy signer;

确定原始签名者OS_i的位置有效时，生成相应的代理授权信息；所述代理授权信息中包含有原始签名者的身份信息、原始签名者的位置信息以及根据所述代理授权密钥包生成的签名dw_i，dw_i表示第i个代理授权密钥包

生成的签名；Step B3: Authorize the key package according to the agent

When it is determined that the location of the original signer OS _i is valid, the corresponding proxy authorization information is generated; the proxy authorization information includes the identity information of the original signer, the location information of the original signer, and the information generated according to the proxy authorization key package. Signature dw _i , dw _i represents the ith agent authorization key package

generated signature;

Step B4: Send the proxy authorization information to a checker (Clerk), wherein the checker is any original signer specified in the original signer group OSG.

Inspector side, including the following steps:

生成的签名dw_i是否由原始签名者OS_i来生成，若是，则dw_i有效，执行步骤C2，若否，则无效，结束流程；Step C1: Determine any original signer specified in the original signer group OSG as a checker, and the checker checks the proxy authorization key package

Whether the generated signature _{dwi is generated by the original signer OS i ,} if yes, then _dwi is valid, and step C2 is executed, if not, it is invalid, and the process ends;

dw表示代理授权证书，dw中包含有所有原始签名者和代理签名者的身份信息、位置信息、可签名消息类型信息、有效期信息；Step C2: Determine whether all dwi _i are valid, i=1, 2, 3, ..., n, if all are valid, generate an agency authorization certificate, let

dw represents the proxy authorization certificate, and dw contains the identity information, location information, signable message type information, and validity period information of all original signers and proxy signers;

Step C3: Send the proxy authorization certificate to the proxy signer PS.

The PS side of the proxy signer includes the following steps:

Step D1: Receive the proxy signature key package pskp sent by the location infrastructure PI and the proxy authorization certificate sent by the inspector;

Step D2: Determine whether the position information Pos _PS of the proxy signer PS itself is valid according to the position positioning protocol encapsulated in the proxy signature key package pskp, if valid, execute step D3; if invalid, end the process; wherein, the position information Pos _PS valid means: the location information of the proxy signer PS is consistent with the location information about the proxy signer PS in the proxy authorization certificate;

Step D3: Send a multi-signature to the signature verifier V, the multi-signature is recorded as: (m,s,dw,pp), (m,s,dw,pp) represents the signature s for the message m, and the value of the signature s is The valid number is 1 time.

The V side of the signature verifier includes the following steps:

Step E1: Receive the proxy multi-signature (m, s, dw, pp) sent by the proxy signer PS;

Step E2: Check whether the proxy authorization certificate is valid through the identity information and location information of the original signer, the identity information and location information of the proxy signer, and the public parameter pp, if valid, then execute step E3, if invalid, then end the process;

(i＝1,2,...,n))进行的签名；若验证失败，则结束流程。Step E3: Verify whether s is the proxy multi-signature of message m through the preset multi-signature verification algorithm. If the verification is successful, it is confirmed that the message m is indeed represented by the proxy signer at the designated position Pos _PS on behalf of the original signer group (at the position of the original signer group).

(i=1,2,...,n)); if the verification fails, the process ends.

It should be noted that the steps in the location-based proxy multi-signature method provided by the present invention can be implemented by using the corresponding modules, devices, units, etc. in the location-based proxy multi-signature system, and those skilled in the art can Referring to the step flow of implementing the method in the technical solution of the system, that is, the embodiment in the system can be understood as a preferred example for implementing the method, which will not be repeated here.

Those skilled in the art know that, in addition to implementing the system provided by the present invention and its respective devices in the form of pure computer-readable program codes, the system provided by the present invention and its respective devices can be made by logic gates, Switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers are used to achieve the same function. Therefore, the system and its various devices provided by the present invention can be regarded as a kind of hardware components, and the devices for realizing various functions included in the system can also be regarded as structures in the hardware components; The means for implementing various functions can be regarded as either a software module implementing a method or a structure within a hardware component.

Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the above-mentioned specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essential content of the present invention. The embodiments of the present application and features in the embodiments may be combined with each other arbitrarily, provided that there is no conflict.

Claims (8)

1. A location-based proxy multi-signature method, characterized in that, comprising: The location-based implementation PI obtains the security parameter 1 ^k , the master key mk, and the public parameter pp during the initialization process, and sends unique corresponding identity information to each original signer OS in the original signer group OSG; The signer group OSG contains n original signers OS, and the i-th original signer is denoted as OS _i , where i=1, 2, 3,...,n; the identity corresponding to the i-th original signer OS _i The information is ID _i , and n represents the total number of original signers; Receive the proxy signature request information sent from the original signer OS _i , where the proxy signature request information includes the location information corresponding to the original signer OS _i

Determine the location information corresponding to each original signer OS _i through the location location protocol

When it is valid information, send corresponding confirmation information to each original signer OS _i ; and generate proxy authorization key package

i=1,2,3,...,n;

Indicates the proxy authorization key package corresponding to the i-th original signer; Send the corresponding proxy authorization key package to each original signer

Receive the proxy authorization certificate dw sent by the checker side, and the dw contains the identities, locations, signable message types, and validity period information of all original signers and proxy signers; Generate a proxy signature key package pskp according to the proxy authorization certificate dw, and send it to the proxy signer PS; wherein, the proxy signature key package pskp is generated by the proxy signer at a specified location, and the checker is Any original signer specified in the original signer group OSG. 2. location-based proxy multi-signature method according to claim 1, is characterized in that, in described proxy authorization key package, is encapsulated with location location protocol, authorization key, identity information of corresponding original signer, proxy signer The identity information of the original signer, the location information of the corresponding original signer, and the location information of the proxy signer; The proxy signature key package pskp encapsulates a location location protocol, a proxy signature key, the identity information of the proxy signer, the location information of the proxy signer, and a signature algorithm. 3. The location-based proxy multi-signature method according to claim 1 or 2, wherein the location location protocol comprises: a global positioning system (GPS) protocol for determining the location of the original signer and the proxy signer. 4. A location-based proxy multi-signature method, comprising: The original signer OS _i sends proxy signature request information to the location infrastructure PI, where the proxy signature request information includes the location information corresponding to the original signer OS _i

where OS _i represents the i-th original signer,

Represents the location information corresponding to the i-th original signer, where i=1, 2, 3,..., n, n represents the total number of original signers; The original signer OS _i receives the agent authorization key package sent by the location base implementation PI

Indicates the proxy authorization key package corresponding to the i-th original signer; Authorize keybags according to the agent

When it is determined that the location of the original signer OS _i is valid, the corresponding proxy authorization information is generated; the proxy authorization information includes the identity information of the original signer, the location information of the original signer, and the information generated according to the proxy authorization key package. Signature dw _i , dw _i represents the ith agent authorization key package

The generated signature; wherein, the proxy signature key package pskp is generated when the proxy signer is in a specified position; The proxy authorization information is sent to a checker, wherein the checker is any one of the original signers specified in the original signer group OSG. 5. location-based proxy multi-signature method according to claim 4, is characterized in that, in the proxy authorization key package, is encapsulated with location location protocol, authorization key, the identity information of corresponding original signer, the identity of the proxy signer information, the location information of the corresponding original signer, and the location information of the proxy signer. 6. The location-based proxy multi-signature method according to claim 4 or 5, characterized in that, when the original signer acts as a checker, it further comprises: Determine any original signer specified in the original signer group OSG as a checker, and the checker checks the agent authorization key package

Whether the generated signature _{dwi is generated by the original signer OS i ,} If not, it is invalid, and the process ends; if, Then dwi _i is valid, judge whether all dwi _i are valid, i=1, 2, 3,..., n, if all are valid, generate an agency authorization certificate, let

dw represents the proxy authorization certificate, and dw contains the identity information, location information, signable message type information, and validity period information of all original signers and proxy signers; A proxy authorization certificate is sent to the proxy signer PS. 7. A location-based proxy multi-signature method, comprising: Receive the proxy signature key package pskp sent by PI and the proxy authorization certificate sent by the checker; wherein, the proxy signature key package pskp is generated by the proxy signer at the specified location, and the checker is the original Any original signer specified in the signer group OSG; Determine whether the location information Pos _PS of the proxy signer PS itself is valid according to the location positioning protocol encapsulated in the proxy signature key package pskp, and if it is invalid, end the process; If valid, Then send a multi-signature to the signature verifier V, the multi-signature is recorded as: (m,s,dw,pp), (m,s,dw,pp) represents the signature s for the message m, and the number of times the signature s is valid is 1 time; The validity of the location information Pos _PS means that the location information of the proxy signer PS is consistent with the location information about the proxy signer PS in the proxy authorization certificate. 8. A location-based proxy multi-signature system, comprising: location infrastructure PI, original signer OS, proxy signer PS, and signature verifier V; wherein, The location infrastructure PI is used to perform the location-based proxy multi-signature method of any one of claims 1-3; The original signer OS is used to execute the location-based proxy multi-signature method of any one of claims 4-6; The proxy signer PS is used to perform the location-based proxy multi-signature method of claim 7; The signature verifier V is used to receive the proxy multi-signature (m, s, dw, pp) sent by the proxy signer PS; wherein, (m, s, dw, pp) represents the signature s for the message m, and the signature s The valid number of times is 1; Check whether the proxy authorization certificate is valid through the identity information and location information of the original signer, the identity information and location information of the proxy signer, and the public parameter pp. If it is invalid, the process ends; If it is valid, the preset multi-signature verification algorithm is used to verify whether s is the proxy multi-signature of message m. If the verification is successful, it is confirmed that the message m is indeed represented by the proxy signer at the specified position Pos _PS on behalf of the original signer group.

Images