CN116318726A - A condition traceable ring signature method, system, electronic device and storage medium - Google Patents

Abstract

The invention discloses a condition traceable ring signature method, a system, an electronic device and a storage medium, wherein the method comprises the following steps: setting system parameters; generating a key for the user and the anonymous revocation authority according to the digital signature algorithm and the system parameters; generating a ring signature according to the secret key; verifying the ring signature, outputting a first preset result if the verification is passed, and outputting a second preset result if the verification is not passed; performing ring signature link, and judging whether to add the ring signature into a signature list through the ring signature link; if the ring signature appears in the signature list, the anonymous revocation authority wants to recover the signature public key through the private key, and the private key of the anonymous revocation authority is substituted into the pre-mixed public key set to trace the public key of the actual signer; the signature list function is added in the ring signature algorithm, so that the anonymous revocation authority can only revoke the anonymity of the ring signature in the signature list, thereby achieving the effect of reducing the authority of the anonymous revocation authority and realizing the partial traceability of the ring signature.

Description

A condition traceable ring signature method, system, electronic device and storage medium

technical field

The invention relates to the field of digital signatures, in particular to a condition traceable ring signature method, system, electronic device and storage medium.

Background technique

In digital signatures, there is an identity-based ring signature scheme, which distributes private keys through a private key generator (PKG), which can simultaneously realize the linkability and traceability of ring signatures. If compromised, the user's signature private key will be leaked, which poses certain security risks. In addition, the authority of the anonymous revocation authority in the traditional traceable ring signature is too high. In theory, the anonymity of all traceable ring signatures can be revoked, but in practical applications, only malicious signers are found. Without conspiracy, it is not safe for honest signers.

Therefore, there is an urgent need for a solution that can achieve partial traceability of ring signatures.

Contents of the invention

The main purpose of the present invention is to provide a conditionally traceable ring signature method, system, electronic device and storage medium, which can realize partial traceability of the ring signature.

In order to achieve the above object, the first aspect of the present invention provides a conditionally traceable ring signature method, including: setting system parameters; generating keys for users and anonymous revocation authorities according to the preset digital signature algorithm and the system parameters; The key generates a ring signature; the ring signature is verified, and if the verification is passed, the first predetermined result is output, and if the verification fails, the second predetermined result is output; the ring signature is linked to the verified ring signature , judge whether to add the ring signature to the signature list through the ring signature link; if the ring signature appears in the signature list, then the anonymous revocation mechanism wants to recover the signature public key through the private key, then the anonymous Substituting the private key of the revocation authority into the pre-mixed public key set to track the public key of the actual signer; the ring signature linking of the verified ring signature includes: obtaining the key image in the verified ring signature σ I, determine whether the key image I has appeared in the mirror list Ω, if it has, and the message M in the ring signature σ is not equal to the message M' of the signature σ' in the mirror list Ω , then output 1, and delete the σ in the signature list θ, if M is equal to M′, reject the ring signature σ; if it does not appear, output 0, then accept the ring signature σ, and add the ring signature σ to the signature in the list θ.

Further, the setting of system parameters includes: inputting a security parameter l _q , selecting two cyclic groups G ₁ and G _T of the same prime order q, g is a generator of G ₁ , and e represents a bilinear map G ₁ ×G ₁ → G _T , H _s represents the hash function of {0, 1} ^* → Z _q , where Z _q is a finite field, H _p represents the deterministic hash function of G ₁ → G ₁ , and the output public parameter param=( l _q , q, g, G ₁ , G _T , H _s , H _p ).

Further, the user's private key is composed of a random number d _i ∈ Z _q , and the public key is P _i =d _i g; the private key of the anonymous revocation mechanism is d' _u ∈ Z _q , and the public key is P' _u = d' _u g.

Further, the method for generating a ring signature according to the key includes:

Randomly select the public keys of n-1 users and mix them with the signature public keys of n-1 users to obtain a set S={P ₁ , P ₂ ,...,P _n }, set the signature public key to P _π , The private key is d _π , the number of anonymous revocation organizations selected by the signer is l, and its public key set is denoted by T, T={P′ ₁ , P′ ₂ ,...,P′ _l };

Calculate the key image I of d _π , I=d _π H _p (P _π );

Choose {q _i |i=1,...,n, i≠π} and {w _i |i=1,...,n, i≠π} in the finite field Z _q , calculate L _i =q _i g+w _i P _i (i≠π) and R _i =q _i H _p (P _i )+w _i I(i≠π), and choose a random number q _π in the finite field Z _q to calculate L _π =q _π g and R _π =q _π H _p (P _π );

Select a random number r _revoke in the finite field z _q , calculate R _revoke =t _revoke g;

select u=1,...,l, compute

r_i＝q_i(i≠π)，r_i＝q_π-c_πd_πmod q(i＝π)；Calculate c = H _s (M, L ₁ , ..., L _n , R ₁ , ..., R _n ), c _i = w _i (i≠π),

r _i =q _i (i≠π), r _i =q _π -c _π d _π mod q(i=π);

s＝p₁-c′d_π，

s_π＝p₂-c′_πd_πmod q；Select random numbers p ₁ , p ₂ , s _i , c′ _i in the finite field Z _q , = compute

s=p ₁ -c'd _π ,

s _π = p ₂ -c′ _π d _π mod q;

Generate a ring signature σ;

Among them, σ=(I, c ₁ , ..., c _n , r ₁ , ..., r _n , c′ ₁ , ..., c′ _n , s, s ₁ , ... s _n , R _revoke , E ₁ , . . . , E _l ).

Further, the verifying the ring signature includes:

For i=1...n, calculate L' _i =r _i g+ _ci P _i , R' _i =r _i H _p (P _i )+ci _I ;

Calculate w ₁ =H _s (M|L' ₀ ,...,L' _n ||R' ₀ ,...,R' _n ) mod q,

且/>

成立，则输出第一预定结果1，验证通过；否则输出第二预定结果0，验证失败。like

and/>

If it is established, the first predetermined result 1 is output, and the verification passes; otherwise, the second predetermined result 0 is output, and the verification fails.

是否成立，找出使等式成立的公钥P_π，公钥P_π为实际签名者的公钥。Further, the substituting the private key of the anonymous revocation authority into the pre-mixed public key set, and tracing the public key of the actual signer includes: substituting the private key d' _u of the anonymous revocation authority into the public keys in the set S in turn. key, for i=1,...,n, compute

Whether it is true or not, find out the public key P _π that makes the equation true, and the public key P _π is the public key of the actual signer.

The second aspect of the present invention provides a conditionally traceable ring signature system, including: a parameter setting module, used to set system parameters; The revocation mechanism generates a key; the ring signature generation module is used to generate a ring signature according to the key; the ring signature verification module is used to verify the ring signature, if the verification is passed, then output the first predetermined result, if the verification If it fails, then output the second predetermined result; the ring signature linking module is used to perform ring signature linking on the ring signature verified through the ring signature link, and judge whether to add the ring signature to the signature list through the ring signature link; the tracking module is used if When the ring signature linking module determines that the ring signature appears in the signature list, if the anonymous revocation mechanism wants to recover the signature public key through the private key, then substitute the private key of the anonymous revocation mechanism into the pre-mixed The public key set traces the public key of the actual signer; the ring signature link module includes: a judging unit and an execution unit; the judging unit is used to obtain the key image I in the ring signature σ that has passed the verification, and judge the key image I Whether it has appeared in the mirror list Ω; the execution unit is used to judge in the judging unit if it has appeared, and the message M in the ring signature σ is not the same as the message M' with the signature σ' in the mirror list Ω If they are equal, output 1, and delete σ in the signature list θ, if M is equal to M′, reject the ring signature σ; if not, output 0, then accept the ring signature σ, and add the ring signature σ to in the signature list θ.

The third aspect of the present invention provides an electronic device, including: a memory and a processor, the memory stores a computer program that can run on the processor, and when the processor executes the computer program, the above-mentioned The conditions described in any one of the traceable ring signature methods.

The fourth aspect of the present invention provides a computer-readable storage medium on which a computer program is stored, wherein, when the computer program is executed by a processor, the conditionally traceable ring signature method described in any one of the above is implemented .

The present invention provides a conditionally traceable ring signature method, system, electronic device and storage medium. The beneficial effect is that: a signature list function is added to the linkable ring signature algorithm. If both transaction parties are honest, the signature list is empty. If there is a dishonest transaction party, his signature will be kept in the signature list, so that the anonymous revocation authority can only revoke the anonymity of the ring signature in the signature list, thereby reducing the authority of the anonymous revocation authority and realizing the ring signature part of the traceability.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without creative work.

FIG. 1 is a flow chart of a conditionally traceable ring signature method according to an embodiment of the present invention;

Fig. 2 is a frame diagram of a conditionally traceable ring signature system according to an embodiment of the present invention;

FIG. 3 is a schematic block diagram of the structure of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, features and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described The embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts belong to the protection scope of the present invention.

Please refer to Figure 1 for a conditionally traceable ring signature method, including:

S101, setting system parameters;

S102. Generate a key for the user and the anonymous revocation authority according to the preset digital signature algorithm and system parameters;

S103. Generate a ring signature according to the key;

S104. Verify the ring signature, if the verification is passed, output a first predetermined result, and if the verification fails, output a second predetermined result;

S105. Perform a ring signature link on the verified ring signature, and determine whether to add the ring signature to the signature list through the ring signature link;

S106. If the ring signature appears in the signature list, the anonymous revocation authority wants to recover the signature public key through the private key, then substitute the private key of the anonymous revocation authority into the pre-mixed public key set, and trace the public key of the actual signer ;

In this embodiment, there are three roles: an anonymous revocation authority, a signer, and a verifier, each of which assumes different responsibilities. The anonymous revocation agency acts as the supervisor in the transaction, the signer is the transaction sender, and the verifier is the verification node of the blockchain. The embodiment of this application proposes six algorithms for conditionally traceable ring signatures including system parameter setting, key generation, ring signature generation, ring signature verification, ring signature chaining, and anonymous revocation.

Among them, in step S101, setting the system parameters includes: inputting the security parameter l _q , selecting two cyclic groups G ₁ and G _T of the same prime number order q, g is the generator of G ₁ , and represents the bilinear map G ₁ × ₁ → G _T , H _s represents the hash function of {0, 1} ^* → Z _q , where Z _q is a finite field, H _p represents the deterministic hash function of G ₁ → G ₁ , and the output public parameter param=( l _q , q, g, G ₁ , G _T , H _s , H _p ).

In step S102, the user's private key is composed of random numbers d _i ∈ Z _q , and the public key is P _i =d _i g;

The private key of the anonymous revocation authority is d′ _u ∈ Z _q , and the public key is P′ _u ＝d′ _u g.

In step S103, the method for generating a ring signature according to the key includes:

Randomly select the public keys of n-1 users and mix them with the signature public keys of n-1 users to obtain a set S={P ₁ , P ₂ ,...,P _n }, set the signature public key to P _π , The private key is d _π , the number of anonymous revocation organizations selected by the signer is l, and its public key set is denoted by T, T={P′ ₁ , P′ ₂ ,...,P′ _l };

Calculate the key image I of d _π , I=d _π H _p (P _π );

Choose {q _i |i=1,...,n, i≠π} and {w _i |i=1,...,n, i≠π} in the finite field Z _q , calculate L _i =q _i g+w _i P _i (i≠π) and R _i =q _i H _p (P _i )+w _i I(i≠π), and choose a random number q _π in the finite field Z _q to calculate L _π =q _π g and R _π =q _π H _p (P _π );

Select a random number r _revoke in the finite field Z _q , calculate R _revoke = r _revoke g;

select u=1,...,l, compute

r_i＝q_i(i≠π)，r_i＝q_π-c_πd_π mod q(i＝π)；Calculate c = H _s (M, L ₁ , ..., L _n , R ₁ , ..., R _n ), c _i = w _i (i≠π),

r _i =q _i (i≠π), r _i =q _π -c _π d _π mod q(i=π);

s＝p₁-c′d_π，

s_π＝p₂-c′_πd_πmod q；Select random numbers p ₁ , p ₂ , s _i , c′ _i in the finite field Z _q , = compute

s=p ₁ -c'd _π ,

s _π = p ₂ -c′ _π d _π mod q;

Generate a ring signature σ;

Among them, σ=(I, c ₁ , ..., c _n , r ₁ , ..., r _n , c′ ₁ , ..., c′ _n , s, s ₁ , ... s _n , R _revoke , E ₁ , . . . , E _l ).

In step S104, verifying the ring signature includes:

For i=1...n, calculate L' _i =r _i g+ _ci P _i , R' _i =r _i H _p (P _i )+ci _I ;

Calculate w ₁ =H _s (M|L' ₀ ,...,L' _n ||R' ₀ ,...,R' _n ) mod q,

且/>

成立，则输出第一预定结果1，验证通过；否则输出第二预定结果0，验证失败。like

and/>

If it is established, the first predetermined result 1 is output, and the verification passes; otherwise, the second predetermined result 0 is output, and the verification fails.

In step S105, linking the ring signatures to the verified ring signature includes: obtaining the key image I in the verified ring signature σ, and judging whether the key image I has appeared in the image list Ω, and if so, and If the message M in the ring signature σ is not equal to the message M' of the existing signature σ' in the mirror list Ω, then output 1, and delete the σ in the signature list θ, if M is equal to M', reject the ring signature σ; If it does not appear, output 0, accept the ring signature σ, and add the ring signature σ to the signature list θ.

If the ring signature appears in the signature list, there will be an anonymous revocation. If the ring signature does not appear in the signature list, then the two parties to the transaction will be honest.

In step S105, the verifier obtains the key image I in the ring signature σ that has passed the verification.

是否成立，找出使等式成立的公钥P_π，公钥P_π为实际签名者的公钥。In step S106, substituting the private key of the anonymous revocation authority into the pre-mixed public key set, and tracing the public key of the actual signer includes: substituting the private key d′ _u of the anonymous revocation authority into the public keys in the set S in sequence, For i=1,...,n, compute

Whether it is true or not, find out the public key P _π that makes the equation true, and the public key P _π is the public key of the actual signer.

Therefore, in the conditionally traceable ring signature method provided by the embodiment of this application, in order to realize the partial traceability of the ring signature, the present invention adds a signature list function to the linkable ring signature algorithm. If both parties to the transaction are honest, the signature list is null. If there is a dishonest transaction party, his signature will be kept in the signature list, so that the anonymous revocation authority can only revoke the anonymity of the ring signature in the signature list, thereby reducing the authority of the anonymous revocation authority and realizing the ring signature part of the traceability.

Please refer to Figure 2, the embodiment of the present application also provides a conditionally traceable ring signature system, including: parameter setting module 1, key generation module 2, ring signature generation module 3, ring signature verification module 4, ring signature linking module 5 and tracking module6.

The parameter setting module 1 is used for setting system parameters;

The key generation module 2 is used to generate keys for users and anonymous revocation institutions according to preset digital signature algorithms and system parameters;

The ring signature generating module 3 is used to generate a ring signature according to the key;

The ring signature verification module 4 is used to verify the ring signature, if the verification is passed, the first predetermined result is output, and if the verification fails, the second predetermined result is output;

The ring signature linking module 5 is used to carry out ring signature linking to the ring signatures that have passed the verification, and judge whether to add the ring signature in the signature list through the ring signature linking;

The tracking module 6 is used to replace the private key of the anonymous revocation authority into the pre-mixed public key if the ring signature link module judges that the ring signature appears in the signature list, and if the anonymous revocation authority wants to recover the signature public key through the private key Collection, traced to the public key of the actual signer;

The parameter setting module 1 is specifically used to input the security parameter l _q , select two cyclic groups G ₁ and G _T with the same prime order q, g is the generator of G ₁ , and e represents the bilinear mapping G ₁ ×G ₁ →G _T , H _s represent the hash function of {0, 1} ^* → Z _q , where Z _q is a finite field, H _p represents the deterministic hash function of G ₁ → G ₁ , and the output public parameter param=(l _q , q, g, G ₁ , G _T , H _s , H _p ).

Among the keys generated by the key generation module 2, the user’s private key is composed of random numbers d _i ∈ Z _q , and the public key is P _i =d _i g; the private key of the anonymous revocation mechanism is d′ _u ∈ Z _q , and the public key is The key is P' _u = d' _u g.

The ring signature generation module 3 includes: a public key selection unit, a mirror image calculation unit, a first calculation unit, a second calculation unit, a first selection unit, a third calculation unit, a fourth calculation unit, and a ring signature generation unit

The public key selection unit is used to randomly select the public keys of n-1 users, mix them with the signature public keys of n-1 users to obtain a set S={P ₁ , P ₂ ,...,P _n }, and set the signature The public key is P _π , the private key is d _π , the number of anonymous revocation institutions selected by the signer is l, and the public key set is represented by T, T={P′ ₁ , P′ ₂ ,...,P′ _l };

The image calculation unit is used to calculate the key image I of d _π , I=d _π H _p (P _π );

The first computational unit is used to select {q _i |i=1,...,n, i≠π} and {w _i |i=1,...,n, i≠π} in the finite field Z _q , calculate L _i ＝q _i g+w _i P _i (i≠π) and R _i ＝q _i H _p (P _i )+w _i I(i≠π), and select random numbers in the finite field Z _q q _π , calculate L _π =q _π g and R _π =q _π H _p (P _π );

The second calculation unit is used to select a random number r _revoke in the finite field Z _q , and calculate R _revoke = r _revoke g;

The first selection unit is used to select u=1,...,l, calculate

r_i＝q_i(i≠π)，r_i＝q_π-c_πd_πmod q(i＝π)；The third calculation unit is used to calculate c=H _s (M, L ₁ , . . . , L _n , R ₁ , . . . , R _n ), c _i =w _i (i≠π),

r _i =q _i (i≠π), r _i =q _π -c _π d _π mod q(i=π);

s＝p₁-c′d_π，

s_π＝p₂-c′_πd_πmod q；The fourth calculation unit is used to select random numbers p ₁ , p ₂ , s _i , c′ _i in the finite field Z _q , = calculate

s=p ₁ -c'd _π ,

s _π = p ₂ -c′ _π d _π mod q;

The ring signature generation unit is used to generate the ring signature σ;

Among them, σ=(I, c ₁ , ..., c _n , r ₁ , ..., r _n , c′ ₁ , ..., c′ _n , s, s ₁ , ... s _n , R _revoke , E ₁ , . . . , E _l ).

The ring signature link module 5 includes: a judgment unit and an execution unit; the judgment unit is used to obtain the key image I in the ring signature σ that has passed the verification, and judges whether the key image I has appeared in the mirror list Ω; The judging unit judges that if it has occurred, and the message M in the ring signature σ is not equal to the message M' of the existing signature σ' in the mirror list Ω, then output 1, and delete the σ in the signature list θ, if M is equal to M' , then reject the ring signature σ; if it does not appear, output 0, then accept the ring signature σ, and add the ring signature σ to the signature list θ.

The ring signature verification module 4 includes: the fifth computing unit, the sixth computing unit and an output unit;

The fifth calculation unit is used for i=1...n, calculate L' _i =r _i g+ci _{P i ,} R' _i =r _i H _p (P _i )+ci _I ;

The sixth calculation unit is used to calculate w ₁ =H _s (M|L′ ₀ , . . . , L′ _n ||R′ ₀ , . . . , R′ _n ) mod q,

且/>

成立，则输出第一预定结果1，验证通过；否则输出第二预定结果0，验证失败。The output unit is used if

and/>

If it is established, the first predetermined result 1 is output, and the verification passes; otherwise, the second predetermined result 0 is output, and the verification fails.

是否成立，找出使等式成立的公钥P_π，公钥P_π为实际签名者的公钥。The tracking module 6 is specifically used to substitute the private key d' _u of the anonymous revocation authority into the public keys in the set S in turn, and for i=1,...,n, calculate

Whether it is true or not, find out the public key P _π that makes the equation true, and the public key P _π is the public key of the actual signer.

Therefore, in the conditionally traceable ring signature system provided by the embodiment of this application, in order to realize the partial traceability of the ring signature, the present invention adds a signature list function to the linkable ring signature algorithm. If both parties to the transaction are honest, the signature list is null. If there is a dishonest transaction party, his signature will be kept in the signature list, so that the anonymous revocation authority can only revoke the anonymity of the ring signature in the signature list, thereby reducing the authority of the anonymous revocation authority and realizing the ring signature part of the traceability.

An embodiment of the present application provides an electronic device, please refer to FIG. 3 , the electronic device includes: a memory 601, a processor 602, and a computer program stored in the memory 601 and operable on the processor 602, and the processor 602 executes the computer program. The program implements the conditionally traceable ring signature method described in the foregoing.

Further, the electronic device further includes: at least one input device 603 and at least one output device 604 .

The above-mentioned memory 601 , processor 602 , input device 603 and output device 604 are connected through a bus 605 .

Wherein, the input device 603 may specifically be a camera, a touch panel, a physical button or a mouse, and the like. The output device 604 may specifically be a display screen.

The memory 601 may be a high-speed random access memory (RAM, Random Access Memory) memory, or a non-volatile memory (non-volatile memory), such as a disk memory. The memory 601 is used to store a set of executable program codes, and the processor 602 is coupled to the memory 601 .

Further, the embodiment of the present application also provides a computer-readable storage medium, which can be set in the electronic device in each of the above-mentioned embodiments, and the computer-readable storage medium can be the aforementioned memory 601. A computer program is stored on the computer-readable storage medium, and when the program is executed by the processor 602, the conditionally traceable ring signature method described in the foregoing embodiments is implemented.

Further, the computer storage medium may also be various media capable of storing program codes such as a U disk, a mobile hard disk, a read-only memory 601 (ROM, Read-Only Memory), RAM, a magnetic disk or an optical disk.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or modules may be in electrical, mechanical or other forms.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or may be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.

If the integrated modules are realized in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention.

It should be noted that, for the sake of simplicity of description, the aforementioned method embodiments are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence. Because of the present invention, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the above-mentioned embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

The above is a description of a conditionally traceable ring signature method, system, electronic device, and storage medium provided by the present invention. For those skilled in the art, based on the idea of the embodiment of the present invention, both the specific implementation and the scope of application There will be changes. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (9)

1. A condition-traceable ring signature method, comprising:

setting system parameters;

generating keys for users and anonymous revocation institutions according to a preset digital signature algorithm and the system parameters;

generating a ring signature according to the secret key;

verifying the ring signature, outputting a first preset result if the verification is passed, and outputting a second preset result if the verification is not passed;

performing ring signature link on the ring signature which passes verification, and judging whether the ring signature is added into a signature list or not through the ring signature link;

if the ring signature appears in the signature list, the anonymous revocation authority wants to recover a signature public key through a private key, and the private key of the anonymous revocation authority is substituted into a pre-mixed public key set to track the public key of an actual signer;

the link of the ring signature for the ring signature passing verification comprises the following steps: obtaining a key mirror image I in a verified ring signature sigma, judging whether the key mirror image I appears in a mirror image list omega, outputting 1 if the key mirror image I appears and the message M in the ring signature sigma is not equal to the message M ' with the signature sigma ' in the mirror image list omega, deleting sigma in a signature list theta, and rejecting the ring signature sigma if M is equal to M '; if not, outputting 0, accepting the ring signature sigma, and adding the ring signature sigma to the signature list theta.

2. The condition-traceable ring signature method according to claim 1, wherein,

the setting system parameters comprises: inputting a security parameter l _q Selecting two cyclic groups G with the same prime order q ₁ And G _T G is G ₁ E represents the bilinear map G ₁ ×G ₁ →G _T ，H _s Representing {0,1} ^* →Z _q Wherein Z is _q Is a finite field, H _p Represents G ₁ →G ₁ Deterministic hash function, outputting common parameter param= (l) _q ，q，g，G ₁ ，G _T ，H _s ，H _p )。

3. The condition-traceable ring signature method of claim 2, wherein,

the private key of the user is composed of a random number d _i ∈Z _q Is composed of public key P _i ＝d _i g；

The private key of the anonymous revocation mechanism is d' _u ∈Z _q The public key is P' _u ＝d′ _u g。

4. The condition-traceable ring signature method of claim 3, wherein,

the method for generating the ring signature according to the key comprises the following steps:

randomly selecting the public keys of n-1 users, and mixing the public keys with the signature public keys of n-1 users to obtain a set S= { P ₁ ，P ₂ ，...，P _n Setting the public signature key to P _π The private key is d _π The number of anonymous revocation mechanisms selected by the signer is l, the public key set is represented by T, and T= { P' ₁ ，P′ ₂ ，...，P′ _l }；

Calculate d _π Key mirror I, i=d of (a) _π H _p (P _π )；

In the finite field Z _q Is { q } _i I=1,.. _i I=1,.. _i ＝q _i g+w _i P _i (i+.pi) and R _i ＝q _i H _p (P _i )+w _i I (i.noteq.pi.), and in the finite field Z _q In selecting a random number q _π Calculate L _π ＝q _π g and R _π ＝q _π H _p (P _π )；

In the finite field Z _q In selecting a random number r _revoke Calculating R _revoke ＝r _revoke g；

Select u=1.., l, calculate

Calculate c=h _s (M，L ₁ ，...，L _n ，R ₁ ，...，R _n )，c _i ＝w _i (i≠π)，

r _i ＝q _i (i≠π)，r _i ＝q _π -c _π d _π mod q(i＝π)；

In the finite field Z _q In selecting a random number p ₁ ，p ₂ ，s _i ，c′ _i Calculation of =

s＝p ₁ -c′d _π ，

s _π ＝p ₂ -c′ _π d _π mod q；

Generating a ring signature sigma;

wherein σ= (I, c ₁ ，...，c _n ，r ₁ ，...，r _n ，c′ ₁ ，...，c′ _n ，s，s ₁ ，...s _n ，R _revoke ，E ₁ ，...，E _l )。

5. The condition-traceable ring signature method of claim 4, wherein,

the verifying the ring signature includes:

for i=1..n, calculate L' _i ＝r _i g+c _i P _i ，R′ _i ＝r _i H _p (P _i )+c _i I；

Calculating w ₁ ＝H _s (M|L′ ₀ ，...，L′ _n ||R′ ₀ ，...，R′ _n )mod q，

If it is

And->

If so, outputting a first preset result 1, and passing the verification; otherwise, outputting a second preset result 0, and failing verification.

6. The condition-traceable ring signature method of claim 5, wherein,

substituting the private key of the anonymous revocation authority into a pre-mixed public key set, and tracking the public key of an actual signer comprises:

private key d 'of the anonymous revocation authority' _u The public keys in set S are substituted in sequence, and for i=1..n, calculation is performed

Whether or not to hold, find out the public key P for holding the equation _π Public key P _π Is the public key of the actual signer.

7. A condition-traceable ring signature system, comprising:

the parameter setting module is used for setting system parameters;

the key generation module is used for generating keys for users and anonymous revocation institutions according to a preset digital signature algorithm and the system parameters;

the ring signature generation module is used for generating a ring signature according to the secret key;

the ring signature verification module is used for verifying the ring signature, outputting a first preset result if the ring signature passes verification, and outputting a second preset result if the ring signature does not pass verification;

the ring signature link module is used for carrying out ring signature link on the ring signature which passes verification, and judging whether the ring signature is added into a signature list or not through the ring signature link;

the tracking module is used for substituting the private key of the anonymous revocation authority into a pre-mixed public key set to track the public key of an actual signer if the anonymous revocation authority wants to recover the public signature key through the private key when the ring signature link module judges that the ring signature appears in the signature list;

the ring signature linking module includes: a judging unit and an executing unit; the judging unit is used for acquiring the key image I in the ring signature sigma passing verification and judging whether the key image I appears in the image list omega; the execution unit is used for outputting 1 if the judgment unit judges that the message M in the ring signature sigma is not equal to the message M ' with the signature sigma ' in the mirror list omega, deleting the sigma in the signature list theta, and rejecting the ring signature sigma if M is equal to M '; if not, outputting 0, accepting the ring signature sigma, and adding the ring signature sigma to the signature list theta.

8. An electronic device, comprising: a memory, a processor, on which a computer program is stored which is executable on the processor, characterized in that the processor, when executing the computer program, implements the method according to any one of claims 1 to 6.

9. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the method of any of claims 1 to 6.

Images