CN112152813B - Certificateless content extraction signcryption method supporting privacy protection - Google Patents

Abstract

The invention provides a certificateless content extraction signcryption method supporting privacy protection. The key generation center of the invention constructs a finite field by selecting prime numbers of bits, selects a circular addition group with the order of prime numbers to construct an elliptic parameter according to the finite field, randomly selects a master key to calculate a master public key, and selects a hash function to further generate partial secret keys of users and construct private keys and public keys of the users; dividing an original message into a plurality of sub-message blocks, constructing a salt tree, calculating commitment values of the sub-message blocks by combining root salt values generated by the salt tree, constructing a commitment binary tree, assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub-message blocks, and generating a signature of the original message by a signer according to the commitment binary tree; extracting the signcrypter to execute a signcryption extraction algorithm, extracting the privacy message and executing signcryption operation; the verifier executes the signcryption verification algorithm to return a verification message. The invention improves the signature efficiency and the certificate management security.

Description

Certificateless content extraction signcryption method supporting privacy protection

Technical Field

The invention belongs to the field of information security, and particularly relates to a certificateless content extraction signcryption method supporting privacy protection.

Background

Blockchain intelligence contract data originates from cross-chains, side chains, or the internet, etc., but essentially originates from outside the blockchain. Therefore, security of intelligent contracts to access data outside the chain is very important. The digital signature technology is used as a basic technology and measure for guaranteeing network information safety, can realize safety attributes such as authentication, integrity and the like, and is very important for guaranteeing the network information safety.

Common digital signatures require that an attacker cannot forge the signature of a new message, thereby ensuring the security of the message. This requirement, however, prevents the signer from operating properly on the signed data to some extent. In 2001, Steinfeld R and the like firstly propose content extraction signatures and also give a specific implementation scheme. The content extraction signature is different from the common digital signature, the content extraction signature supports that under the condition that the content extraction signature does not interact with an original signer, a signature holder can extract a required message block from a signed message according to the requirement, meanwhile, the signature is calculated for the extracted message block, a trusted third party can prove the authenticity of the extracted message block, and therefore the content extraction signature is widely applied. However, the content extraction signature has three problems to be solved:

when the current content extraction signature sends verification information to a verifier, privacy protection is lacked;

the traditional public key system needs a digital certificate to ensure the consistency of the user identity and the public key, and has the problem of certificate management;

in a certificateless public key cryptosystem, the signature based on bilinear pairwise operation has high cost and low efficiency.

Disclosure of Invention

The invention mainly solves the technical problems in the prior art and provides an intelligent contract out-of-chain data access method and system based on content extraction signcryption. The method and the system adopt a certificateless content extraction signcryption technology supporting privacy protection, and the problem of privacy data leakage is solved based on content extraction signcryption, so that privacy protection in a signature process is realized. And elliptic curve encryption and certificateless design are adopted, so that the problems of low signature efficiency and certificatemanagement are solved.

The technical problem of the invention is mainly solved by the following technical scheme:

a certificateless content extraction signcryption method to support privacy protection, comprising:

step 1, a key generation center constructs a finite field by selecting k-bit prime numbers, a circular addition group with the order of prime numbers constructs an elliptic parameter according to the finite field, a master key is randomly selected to calculate a master public key, the key generation center selects a hash function, the master key is stored, public parameters are constructed, partial secret keys of a user are further generated, and a private key and a public key of the user are constructed;

step 2, dividing the original message into a plurality of sub-message blocks, constructing a salt tree, calculating the commitment value of the sub-message blocks by combining the sub-message blocks with the root salt value generated by the salt tree, constructing a commitment binary tree, assigning values to leaf nodes of the commitment binary tree according to the commitment value of the sub-message blocks, and generating the signature of the original message by a signer according to the commitment binary tree;

step 3, extracting the signcryption person to execute a signcryption extraction algorithm, extracting the privacy message and executing signcryption operation;

step 4, the verifier executes the signcryption verification algorithm to return verification information;

preferably, the finite field in step 1 is F_pOf order p^k；

Step 1, the circular addition group with prime order is selected, and ellipse parameters are constructed according to a finite field as follows:

the key generation center selects a cyclic addition group G with the order of prime p, defining E/F_pIs a finite field F_pThe above elliptic curve, P is the generator of G, gets { F_p,E/F_pG, P }, E represents an elliptic curve, E/F_pDefining elliptic curve in finite field F_pThe above step (1);

step 1 said randomly selecting master key to calculate master public key is:

key generation center random selection parameters

x is the main key, the main key x is kept secret, and the main public key P is obtained through calculation_pub＝xP，

An integer group of an arbitrary order;

step 1, the key generation center selects a hash function as follows:

H₂:{0,1}^*→G，H₃:{0,1}^*→G、

H₁、H₂、H₃、H₄sequentially represents a first collision-free hash function, a second collision-free hash function, a third collision-free hash function, a fourth collision-free hash function, {0,1}^*Representing a set of combinations of binary sequences of arbitrary bit length,

integer groups of arbitrary order are represented, → representing a set-to-group mapping;

the construction public parameters in the step 1 are as follows:

params＝{F_p,E/F_p,G,P,H₁,H₂,H₃,H₄}

the step 1 of generating the partial secret key of the user is as follows:

user A randomly selects parameters

Calculating P as a secret value_A＝x_AP, mixing P_ATo a key generation center, P_AGenerating element for user A;

the key generation center passes through a system master key x and a generation element P of a user A_AAnd a common parameter, params ═ F_p,E/F_p,G,P,H₁,H₂,H₃,H₄Calculating to obtain a partial secret key D of the user A_AThe method comprises the following steps:

key generation center random selection parameters

R_A＝r_AP, calculate h_A＝H₁(ID_A,R_A,P_A) Wherein ID_AFor the identity of user A in an identity-based cryptographic environment, R_ATo sign a key, P_AGenerating element for user A;

the key generation center calculates s_A＝(r_A+h_Ax) mod n, mod being modular transportCalculating s_AFor the parameters of the partial key of the user A, the partial key D of the user A is generated by combining the signing key_A＝{s_A,R_AAnd sending the data to the user A;

step 1, the private key and the public key of the user are constructed as follows:

user A converts the secret value of user A, namely x_AAnd a parameter s of a partial key of the user A_AConstructing the private Key SK of user A_AI.e. SK_A＝(x_A,s_A)。

Constructing the public key PK of user A_AI.e. PK_A＝(P_A,R_A)；P_AAs a generator of user A, R_AA signing key for user a;

preferably, in step 2, the original message is divided into a plurality of sub-message blocks, and the specific method includes:

M＝{M[1],M[2],…,M[i],…,M[n]}

wherein M is an original message, M [ i ] represents the ith sub-message block, n is the number of the sub-message blocks, and i belongs to [1, n ];

2, inputting a random value to the constructed salt tree, and obtaining a pseudorandom root salt value through a variable-length pseudorandom model to construct the salt tree;

step 2, the commitment value of the sub-message block is calculated by combining the sub-message block with the root salt value generated by the salt tree, and is as follows:

wherein C [ i ] represents the commitment value of the ith sub-message block, C represents a commitment algorithm, and the commitment value about the message block is generated, and the privacy of the message block M [ i ] can be effectively protected by using the commitment algorithm;

the specific way is that the message block M [ i ]]Corresponding and pseudo-random salt values

Binding and generating a commitment character string

The commitment string c relates to the message M [ i ]]Is determined, the message M' is recalculated during the verification process [ i]Promise of (1)

The validity of the signature can be described by verifying whether c ═ c' is true;

M[i]denotes the ith sub-message block, n is the number of sub-message blocks,

in_rIndicates the message name, i_cIndicating the sub-message block name.

Step 2, constructing a commitment binary tree, and assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub message blocks as follows:

the number of the committed binary tree is L;

the jth node of the kth layer is V_k,j,k∈[1,L],j∈[1,2^k-1]；

For k-th leaf node, the total number of nodes is 2^k-1. Will promise the value c [ i ]]Is given to v_a[i]I.e. v_a[i]＝c[i]；

For k e [1, L-1]Nodes of a layer, every two sibling nodes being subjected to a hash function H₂Calculating v_a＝H₂(v_a[i],v_a[i+1]) All v are obtained_aUntil the final root node value v is obtained₀；

Step 2, the signature of the original message generated by the signer according to the commitment binary tree is as follows:

step 2.1, random selection

As a master key of the system, it is,

randomly selecting a prime number P with k bits for an integer group with an arbitrary order, and calculating a parameter R which is l.P and is a generator of G;

step 2.2, calculating parameter H ═ H₃(v₀,R,PK_A)；H₃Is a third collision-free hash function, v₀To commit a binary tree root node value, PK_AIs the public key of user A;

step 2.3, judging whether gcd (l + h, n) is 1 or not through a greatest common divisor function, if yes, executing step 2.4, and if not, returning to step 2.1; l is the system master key, h is the hash value generated in step 2.6, and n is the number of message blocks;

step 2.4, calculate s ═ (l + h)^-1(x_A+s_A) mod n; l is the system master key, h is the hash value generated in step 2.2, x_AIs the secret value of user A, s_AIs a parameter of the partial key of user a.

Step 2.5, by combining the parameters CEAS, R, s, c [ i ]]_i∈nConstructing the signature of the original message, outputting the signature sigma_F＝(CEAS,R,s,c[i]_i∈n)；

CEAS is content extraction access control structure, R is generator of G, s is system partial key, c [ i ]]_i∈nA set of commitment values for all message blocks;

the signer sends the original message and the signature of the original message to the signer who extracted the signcryption.

Preferably, the extraction of the signature σ of the original message received by the signcryptor in step 3 is performed_FThen, calculating a new root node value v according to the method in the step 2₀At the same time, calculate h_A＝H₁(ID_A,R_A,P_A) And H ═ H₃(v₀,R,PK_A)；

ID_AFor the identity of user A in an identity-based encrypted environment, P_AFor a generator, R, of user A_ATo sign the key, h_AFor A-based identity digest hash values, h is the generated hash value, v₀For commitment of a binary tree root node value, R is a generator of G, PK_AIs the public key of user A;

further verify the equation s (R + hP) ═ P_A+R_A+h_AP_pubWhether it is true or not, if the equality is not trueStopping, otherwise, continuing to execute the following steps:

wherein, M '[ i ] represents the extracted sub-message with the number i, ext (i) represents the set of sub-message blocks i in the original message M contained in the sub-message set M', CEAS is the content extraction access structure, and i is the sub-message block name.

Constructing ext (i) from the content extraction access structure CEAS; CEAS is a content extraction access control structure, ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

replacing M { M [1], M [2], …, M ' [ i ], …, M ' [ n ] } by M ═ { M [1], M [2], …, M [ i ], …, M [ n ] }, if i ∈ ext (i), then M ' [ i ] ═ M [ i ], indicating that the sub-message block was extracted; otherwise, M' [ i ] ═ c [ i ]; m '[ i ] represents the extracted sub-message with the number of i, M [ i ] represents the sub-message block with the original number of i, and ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

calculation of E_A＝l(P_A+R_A+h_AP_pub)，

l is the system master key, P_AOne generator, R, for user A_ATo sign the key, h_AAs identity ID based on A_ADigest hash value, P_pubIs the system master public key, E_AFor the encryption key, M' is the set of sub-messages, E is the encryption ciphertext, H₄In order to be a function of the hash function,

is an exclusive or operation;

step 3.4, output and extraction signcryption sigma_EAnd E is an encrypted ciphertext, CEAS is a content extraction access control structure, ext (i) represents a set of sub-message blocks i in an original message M contained in a sub-message set M', R is a generator of G, and s is a system partial key.

Preferably, in step 4, the verifier executing the signcryption verification algorithm returns a verification message that:

the verifier receives the extracted signcryption sigma_EThen, the following operations are performed to verify the signcryption:

step 4.1, judging whether the ext (i) epsilon CEAS is established or not, and if not, terminating the algorithm; otherwise, carrying out the next step; ext (i) represents a set of sub-message blocks i in the original message M contained in a sub-message set M' [ i ], and CEAS is an access control structure for content extraction;

step 4.2, calculate E_B＝s(x_A+s_A)(P_A+R_A+ R + h.P), decryption

s is a system partial key, x_AIs the secret value of user A, s_APartial key D for user A_AParameter of (A), P_AFor a generator, R, of user A_AR is a generator of G, h is a hash value generated in the step 3, and P is a randomly selected prime number;

step 4.3, according to M' [ i ]]And ext (i) recovery v'₀The method comprises the following specific steps: first, it is determined whether i ∈ ext (i) is true, and if so, M' [ i ] is restored]A value of (d); otherwise, keeping the original value unchanged; v 'is then calculated'₀；M'[i]For the regenerated message, ext (i) represents the set of sub-message blocks i, v 'in the original message M contained in the set of sub-messages M'₀A new commitment binary tree root node value is calculated;

step 4.4, calculate h_A＝H₁(ID_A,R_A,P_A) And H is H₄(v₀',R,PK_A) While verifying the equation s (R + hP) ═ P_A+R_A+h_AP_pubAnd if the result is positive, the signcryption verification is successful, otherwise, the signcryption verification fails. ID (identity)_AFor the identity of user A in an identity-based cryptographic environment, P_AFor a generator, R, of user A_AFor the signing key, h is the regenerated hash value, v₀For commitment of a binary tree root node value, R is a generator of G, PK_AIs the public key of user a. h is_AAs identity ID based on A_ADigest hash value, P_pubIs the system master public key.

The method has the advantages that the signcryption is extracted based on the content, so that the problem of privacy data leakage is solved, and privacy protection in the signing process is realized; and elliptic curve encryption and certificateless design are adopted, so that the problems of low signature efficiency and certificatemanagement are solved.

Drawings

FIG. 1: the method of the invention is a flow chart.

FIG. 2: the salt tree and the commitment binary tree generate a graph.

FIG. 3: the signature generates a graph.

FIG. 4: and (5) signcryption extraction of the graph.

FIG. 5: and (5) signing and verifying the graph.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without making any creative effort based on the embodiments in the present invention, belong to the protection scope of the present invention.

The invention provides a certificateless content extraction signcryption method supporting privacy protection, which comprises the following steps:

step 1, a key generation center constructs a finite field by selecting k-bit prime numbers, a circular addition group with the order of prime numbers constructs an elliptic parameter according to the finite field, a master key is randomly selected to calculate a master public key, the key generation center selects a hash function, the master key is stored, public parameters are constructed, partial secret keys of a user are further generated, and a private key and a public key of the user are constructed;

step 1 the finite field is F_pOf order p^k；

Step 1, the circular addition group with prime order is selected, and ellipse parameters are constructed according to a finite field as follows:

the key generation center selects a cyclic addition group G with the order of prime p 13, defining E/F_pIs a finite field F_pThe above elliptic curve, P is the generator of G, gets { F_p,E/F_pG, P }, E represents an elliptic curve, E/F_pDefining elliptic curve in finite field F_pThe above step (1);

step 1 said randomly selecting master key to calculate master public key is:

key generation center random selection parameters

x is the main key, the main key x is kept secret, and the main public key P is obtained through calculation_pub＝xP，

An integer group of an arbitrary order;

step 1, the key generation center selects a hash function as follows:

H₂:{0,1}^*→G，H₃:{0,1}^*→G、

H₁、H₂、H₃、H₄sequentially represents a first collision-free hash function, a second collision-free hash function, a third collision-free hash function, a fourth collision-free hash function, {0,1}^*Representing a set of combinations of binary sequences of arbitrary bit length,

integer groups of arbitrary order are represented, → representing a set-to-group mapping;

the construction public parameters in the step 1 are as follows:

params＝{F_p,E/F_p,G,P,H₁,H₂,H₃,H₄}

the step 1 of generating the partial secret key of the user is as follows:

user A randomly selects parameters

Calculating P as a secret value_A＝x_AP, mixing P_ATo a key generation center, P_AGenerating element for user A;

the key generation center passes through a system master key x and a generation element P of a user A_AAnd a common parameter, params ═ F_p,E/F_p,G,P,H₁,H₂,H₃,H₄Calculating to obtain a partial secret key D of the user A_AThe method comprises the following steps:

key generation center random selection parameters

R_A＝r_AP, calculate h_A＝H₁(ID_A,R_A,P_A) Wherein ID_AFor the identity of user A in an identity-based cryptographic environment, R_ATo sign a key, P_AGenerating element for user A;

the key generation center calculates s_A＝(r_A+h_Ax) mod 8, mod being a modulo operation, s_AFor the parameters of the partial key of the user A, the partial key D of the user A is generated by combining the signing key_A＝{s_A,R_AAnd sending the data to the user A;

step 1, the private key and the public key of the user are constructed as follows:

user A converts the secret value of user A, namely x_AAnd a parameter of a partial key of the user A, i.e. s_AConstructing the private Key SK of user A_AI.e. SK_A＝(x_A,s_A)。

Constructing the public key PK of user A_AI.e. PK_A＝(P_A,R_A)；P_AFor the generator of user A, R_AA signing key for user a;

step 2, dividing the original message into 8 sub-message blocks, constructing a salt tree, calculating commitment values of the sub-message blocks by combining root salt values generated by the salt tree, constructing a commitment binary tree, assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub-message blocks, and generating a signature of the original message by a signer according to the commitment binary tree;

step 2, dividing the original message into a plurality of sub-message blocks, specifically comprising:

M＝{M[1],M[2],…,M[i],…,M[8]}

wherein M is an original message, M [ i ] represents the ith sub-message block, the number of the sub-message blocks is 8, i belongs to [1, …,8 ];

2, inputting a random value into the salt tree construction, and obtaining a pseudorandom root salt value through a variable-length pseudorandom model to construct a salt tree;

step 2, the commitment value of the sub-message block is calculated by combining the sub-message block with the root salt value generated by the salt tree, and is as follows:

wherein C [ i ] represents the commitment value of the ith sub-message block, C represents a commitment algorithm, and the commitment value about the message block is generated, and the privacy of the message block M [ i ] can be effectively protected by using the commitment algorithm;

the specific way is that the message block M [ i ]]Corresponding and pseudo-random salt values

Binding and generating a commitment character string

The commitment string c relates to the message M [ i ]]Is determined, the message M' is recalculated during the verification process [ i]Promise of (1)

The validity of the signature can be described by verifying whether c ═ c' is true;

M[i]indicating the ith sub-message block, the number of sub-message blocks being 8,

in_rIndicates the message name, i_cIndicating the sub-message block name.

Step 2, constructing a commitment binary tree, and assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub message blocks as follows:

the number of the committed binary tree is L;

the jth node of the kth layer is V_k,j,k∈[1,L],j∈[1,2^k-1]；

For the k-th leaf node, the total number of nodes is 2^k-1. Will promise value c [ i ]]Is given to v_a[i]I.e. v_a[i]＝c[i]；

For k e [1, L-1]Nodes of a layer, every two sibling nodes being subjected to a hash function H₂Calculating v_a＝H₂(v_a[i],v_a[i+1]) Obtaining all v_aUntil the final root node value v is obtained₀；

Step 2, the signature of the original message generated by the signer according to the commitment binary tree is as follows:

step 2.1, random selection

As a master key of the system, it is,

randomly selecting a prime number 13 with k bits for an integer group with an arbitrary order, and calculating a parameter R as l.13, wherein R is a generator of G;

step 2.2, calculating parameter H ═ H₃(v₀,R,PK_A)；H₃Is a third collision-free hash function, v₀To commit to a binary tree root node value, PK_AIs the public key of user A;

step 2.3, judging whether gcd (l + h,8) is 1 or not through a greatest common divisor function, if yes, executing step 2.4, otherwise, returning to step 2.1; l is the system master key, h is the hash value generated in step 2.6, and n is the number of message blocks;

step 2.4, calculate s ═ (l + h)^-1(x_A+s_A) mod 8; l is the system master key and h is generated in step 2.2Hash value, x_AIs the secret value of user A, s_AIs a parameter of the partial key of user a.

Step 2.5, by combining the parameters CEAS, R, s, c [ i ]]_i∈nConstructing the signature of the original message, outputting the signature sigma_F＝(CEAS,R,s,c[i]_i∈n)；

CEAS is content extraction access control structure, R is generator of G, s is system partial key, c [ i ]]_i∈nA set of commitment values for all message blocks;

the signer sends the original message and the signature of the original message to the signer.

Step 3, extracting the signcryption person to execute a signcryption extraction algorithm, extracting the privacy message and executing a signcryption operation;

step 3, extracting the signature sigma of the original message received by the signatory_FThen, calculating a new root node value v according to the method in the step 2₀At the same time, calculate h_A＝H₁(ID_A,R_A,P_A) And H ═ H₃(v₀,R,PK_A)；

ID_AFor the identity of user A in an identity-based cryptographic environment, P_AFor a generator, R, of user A_ATo sign the key, h_AFor A-based identity digest hash values, h is the generated hash value, v₀For commitment of a binary tree root node value, R is a generator of G, PK_AA public key for user A;

further verify the equation s (R + h.13) as P_A+R_A+h_AP_pubIf the equation is not satisfied, stopping if the equation is not satisfied, otherwise, continuing to execute the following steps:

wherein, M '[ i ] represents the extracted sub-message with the number i, ext (i) represents the set of sub-message blocks i in the original message M contained in the sub-message set M', CEAS is the content extraction access structure, and i is the sub-message block name.

Constructing ext (i) according to a Content Extraction Access Structure (CEAS); CEAS is a content extraction access control structure, ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

replacing M { M [1], M [2], …, M ' [ i ], …, M ' [ n ] } by M ═ { M [1], M [2], …, M [ i ], …, M [ n ] }, if i ∈ ext (i), then M ' [ i ] ═ M [ i ], indicating that the sub-message block was extracted; otherwise, M' [ i ] ═ c [ i ]; m '[ i ] represents the extracted sub-message with the number of i, M [ i ] represents the sub-message block with the original number of i, and ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

calculation of E_A＝l(P_A+R_A+h_AP_pub)，

l is the system master key, P_AFor a generator, R, of user A_ATo sign the key, h_AAs identity ID based on A_ADigest hash value, P_pubIs a system master public key, E_AFor the encryption key, M' is the set of sub-messages, E is the encryption ciphertext, H₄In order to be a function of the hash function,

is an exclusive or operation;

step 3.4, output and extraction signcryption sigma_EE, CEAS, ext (i), R, s, E is an encrypted ciphertext, CEAS is a content extraction access control structure, ext (i) represents a set of sub-message blocks i in the original message M included in the sub-message set M', R is a generator of G, and s is a system partial key.

Step 4, the verifier executes the signcryption verification algorithm to return verification information;

step 4, the verifier executes the signcryption verification algorithm and returns a verification message as follows:

the verifier receives the extracted signcryption sigma_EThen, the following operations are performed to verify the signcryption:

step 4.1, judging whether the ext (i) epsilon CEAS is established or not, and if not, terminating the algorithm; otherwise, carrying out the next step; ext (i) represents a set of sub-message blocks i in the original message M contained in a sub-message set M' [ i ], and CEAS is a structure for extracting access control for content;

step 4.2, calculate E_B＝s(x_A+s_A)(P_A+R_A+ R + h.p), decryption

s is a system partial key, x_AIs the secret value of user A, s_APartial key D for user A_AParameter of (A), P_AFor a generator, R, of user A_AR is a generator of G, h is a hash value generated in the step 3, and p is a randomly selected prime number 13;

step 4.3, according to M' [ i ]]And ext (i) recovery v'₀The method comprises the following specific steps: first, it is determined whether i ∈ ext (i) is true, and if so, M' [ i ] is restored]A value of (d); otherwise, keeping the original value unchanged; v 'is then calculated'₀；M'[i]For the regenerated message, ext (i) represents the set of sub-message blocks i, v 'in the original message M contained in the set of sub-messages M'₀A new commitment binary tree root node value is calculated;

step 4.4, calculate h_A＝H₁(ID_A,R_A,P_A) And H ═ H₄(v₀',R,PK_A) While verifying the equation s (R + hp) ═ P_A+R_A+h_AP_pubAnd if the result is positive, the signcryption verification is successful, otherwise, the signcryption verification fails. ID_AFor the identity of user A in an identity-based encrypted environment, P_AFor a generator, R, of user A_AFor the signing key, h is the regenerated hash value, v₀For commitment of a binary tree root node value, R is a generator of G, PK_AIs the public key of user a. h is_AAs identity ID based on A_ADigest hash value, P_pubIs the system master public key.

It should be understood that parts of the specification not set forth in detail are well within the prior art.

It should be understood that the above description of the preferred embodiments is illustrative, and not restrictive, and that various changes and modifications may be made therein by those skilled in the art without departing from the scope of the invention as defined in the appended claims.

Claims (3)

1. A certificateless content extraction signcryption method that supports privacy protection, comprising:

step 1, a key generation center constructs a finite field by selecting k-bit prime numbers, a circular addition group with the order of prime numbers constructs an elliptic parameter according to the finite field, a master key is randomly selected to calculate a master public key, the key generation center selects a hash function, the master key is stored, public parameters are constructed, partial secret keys of a user are further generated, and a private key and a public key of the user are constructed;

step 2, dividing the original message into a plurality of sub-message blocks, constructing a salt tree, calculating commitment values of the sub-message blocks by combining root salt values generated by the salt tree, constructing a commitment binary tree, assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub-message blocks, and generating a signature of the original message by a signer according to the commitment binary tree;

step 3, extracting the signcryption person to execute a signcryption extraction algorithm, extracting the privacy message and executing signcryption operation;

step 4, the verifier executes the signcryption verification algorithm to return verification information;

step 3, extracting the signature sigma of the original message received by the signcryptor_FThen, the root node value v is recalculated according to the method in the step 2₀At the same time, h is calculated_A＝H₁(ID_A,R_A,P_A) And H ═ H₃(v₀,R,PK_A)；

ID_AFor the identity of user A in an identity-based cryptographic environment, P_AFor a generator, R, of user A_AFor signing the key, h_AFor A-based identity digest hash values, h is the generated hash value, v₀For commitment of the binary tree root node value, R is a generator of G, PK_AIs the public key of user A;

further verification of the equation, i.e., s (R + hP) ═ P_A+R_A+h_AP_pubIf the equation is not satisfied, stopping if the equation is not satisfied, otherwise, continuing to execute the following steps:

wherein, M '[ i ] represents the extracted sub-message with the number i, ext (i) represents the set of sub-message blocks i in the original message M contained in the sub-message set M', CEAS is a content extraction access structure, and i is the name of the sub-message block;

constructing ext (i) according to a Content Extraction Access Structure (CEAS); CEAS is a content extraction access control structure, ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

replacing M { M [1], M [2], …, M ' [ i ], …, M ' [ n ] } by M ═ { M [1], M [2], …, M [ i ], …, M [ n ] }, if i ∈ ext (i), then M ' [ i ] ═ M [ i ], indicating that the sub-message block was extracted; otherwise, M' [ i ] ═ c [ i ]; m '[ i ] represents the extracted sub-message with the number of i, M [ i ] represents the sub-message block with the original number of i, and ext (i) represents a set of sub-message blocks i in the original message M contained in the sub-message set M';

calculating E_A＝l(P_A+R_A+h_AP_pub)，

l is the system master key, P_AOne generator, R, for user A_ATo sign the key, h_AAs identity ID based on A_ADigest hash value, P_pubIs the system master public key, E_AFor the encryption key, M' is the set of sub-messages, E is the encryption ciphertext, H₄In order to be a function of the hash function,

is an exclusive or operation;

step 3.4, output and extraction signcryption sigma_EE, CEAS, E;

step 4, the verifier executes the signcryption verification algorithm to return verification information as follows:

the verifier receives the extracted signcryption sigma_EThen, the following operations are performed to verify the signcryption:

step 4.1, judging whether the ext (i) epsilon CEAS is established or not, and if not, terminating the algorithm; otherwise, carrying out the next step; ext (i) represents a set of sub-message blocks i in the original message M contained in a sub-message set M' [ i ], and CEAS is a content extraction access control structure;

step 4.2, calculate E_B＝s(x_A+s_A)(P_A+R_A+ R + h.P), decryption

s is the system partial key, x_AIs the secret value of user A, s_APartial key D for user A_AParameter of (A), P_AOne generator, R, for user A_AR is a generator of G, h is a hash value generated in the step 3, and P is a randomly selected prime number;

step 4.3, according to M' [ i ]]And ext (i) recovery v'₀The method comprises the following specific steps: first, it is determined whether i ∈ ext (i) is true, and if so, M' [ i ] is restored]A value of (d); otherwise, keeping the original value unchanged; v 'is then calculated'₀；M'[i]For the regenerated message, ext (i) represents the set of sub-message blocks i, v 'in the original message M contained in the set of sub-messages M'₀A new commitment binary tree root node value is calculated;

step 4.4, calculate h_A＝H₁(ID_A,R_A,P_A) And H ═ H₄(v₀',R,PK_A) While verifying the equation s (R + hP) ═ P_A+R_A+h_AP_pubIf yes, the signcryption verification is successful, otherwise, the signcryption verification fails; ID (identity)_AFor the identity of user A in an identity-based encrypted environment, P_AOne generator, R, for user A_AFor the signing key, h is the regenerated hash value, v₀For commitment of the binary tree root node value, R is a generator of G, PK_AIs the public key of user A; h is_AAs identity ID based on A_ADigest hash value, P_pubIs the system master public key.

2. The certificateless content extraction signcryption method in support of privacy protection as claimed in claim 1, wherein:

step 1 the finite field is F_pOf order p^k；

Step 1, the circular addition group with prime order is selected, and ellipse parameters are constructed according to a finite field as follows:

the key generation center selects a cyclic addition group G with the order of prime p, defining E/F_pIs a finite field F_pThe above elliptic curve, P is the generator of G, gets { F_p,E/F_pG, P }, E represents an elliptic curve, E/F_pDefining elliptic curve in finite field F_pThe above step (1);

step 1 said randomly selecting master key to calculate master public key is:

key generation center random selection parameters

x is the main key, the main key x is kept secret, and the main public key P is obtained through calculation_pub＝xP，

An integer group of an arbitrary order;

step 1, the key generation center selects a hash function as follows:

H₂:{0,1}^*→G；H₃:{0,1}^*→G；

H₁、H₂、H₃、H₄sequentially representing a first collision-free hash function, a second collision-free hash function, a third collision-free hash function and a fourth collision-free hash functionThe Hig function, {0,1}^*Representing a set of combinations of binary sequences of arbitrary bit length,

integer groups of order arbitrary, → representing set-to-group mappings;

the construction public parameters in the step 1 are as follows:

params＝{F_p,E/F_p,G,P,H₁,H₂,H₃,H₄}

the step 1 of generating the partial secret key of the user is as follows:

user A randomly selects parameters

Calculating P as a secret value_A＝x_AP, mixing P_ATo a key generation center, P_AA generator for user A;

the key generation center generates a key by a system master key x and a generation element P of a user A_AAnd a common parameter params ═ F_p,E/F_p,G,P,H₁,H₂,H₃,H₄Calculating to obtain a partial secret key D of the user A_AThe method comprises the following steps:

key generation center random selection parameters

R_A＝r_AP, calculate h_A＝H₁(ID_A,R_A,P_A) Wherein ID_AFor the identity of user A in an identity-based cryptographic environment, R_ATo sign the key, P_AGenerating element for user A;

the key generation center calculates s_A＝(r_A+h_Ax) mod n, mod being a modulo operation, s_AFor the parameters of the partial key of the user A, the partial key D of the user A is generated by combining the signing key_A＝{s_A,R_AAnd sending the data to the user A;

step 1, the private key and the public key of the user are constructed as follows:

user A combines the secret value x of user A_AAnd a parameter s of a partial key of the user a_AConstructing the private Key SK of user A_AI.e. SK_A＝(x_A,s_A)；

Constructing the public key PK of user A_AI.e. PK_A＝(P_A,R_A)；P_AFor the generator of user A, R_AIs the signing key of user a.

3. The certificateless content extraction signcryption method in support of privacy protection as claimed in claim 1, wherein:

step 2, dividing the original message into a plurality of sub-message blocks, specifically comprising:

M＝{M[1],M[2],…,M[i],…,M[n]}

wherein M is an original message, M [ i ] represents the ith sub-message block, n is the number of the sub-message blocks, and i belongs to [1, n ];

2, inputting a random value to the constructed salt tree, and obtaining a pseudorandom root salt value through a variable-length pseudorandom model to construct the salt tree;

step 2, the commitment value of the sub-message block is calculated by combining the sub-message block with the root salt value generated by the salt tree, and is as follows:

wherein C [ i ] represents the commitment value of the sub-message block, C represents the commitment algorithm, and generates the commitment value related to the message block, and the privacy of the message block M [ i ] can be effectively protected by using the commitment algorithm;

the specific way is that the message block M [ i ]]Corresponding and pseudo-random salt values

Binding, generating commitment values for sub-message blocks

The commitment value of a sub-message block is with respect to message M [ i]Is determined, the message M' is recalculated during the verification process [ i]Promise of (1)

By verifying c [ i ]]＝c'[i]Whether the signature is valid or not can indicate the validity of the signature;

M[i]denotes the ith sub-message block, n is the number of sub-message blocks,

in_rIndicates the message name, i_cRepresenting a sub-message block name;

step 2, constructing a commitment binary tree, and assigning values to leaf nodes of the commitment binary tree according to the commitment values of the sub message blocks as follows:

the number of the layers of the commitment binary tree is L;

the jth node of the kth layer is V_k,j,k∈[1,L],j∈[1,2^k-1]；

For the k-th leaf node, the total number of nodes is 2^k-1(ii) a Will promise the value c [ i ]]To v_a[i]I.e. v_a[i]＝c[i]；

For k e [1, L-1]Nodes of a layer, every two sibling nodes being subjected to a hash function H₂Calculating v_a＝H₂(v_a[i],v_a[i+1]) All v are obtained_aUntil the final root node value v is obtained₀；

Step 2, the signature of the original message generated by the signer according to the commitment binary tree is as follows:

step 2.1, random selection

As a master key of the system, it is,

randomly selecting a prime number P with k bits for an integer group with an arbitrary order, and calculating a parameter R which is l.P and is a generator of G;

step 2.2, calculating parameter H ═ H₃(v₀,R,PK_A)；H₃Is a third collision-free hash function, v₀To commit to a binary tree root node value, PK_AIs the public key of user A;

step 2.3, judging whether gcd (l + h, n) is 1 or not through a greatest common divisor function, if yes, executing step 2.4, otherwise, returning to step 2.1; l is a system master key, h is a hash value generated in the step 2.2, and n is the number of message blocks;

step 2.4, calculate s ═ (l + h)^-1(x_A+s_A) mod n; l is the system master key, h is the hash value generated in step 2.2, x_AIs the secret value of user A, s_AA parameter of a partial key for user a;

step 2.5, by combining the parameters CEAS, R, s, c [ i ]]_i∈nConstructing the signature of the original message, outputting the signature sigma_F＝(CEAS,R,s,c[i]_i∈n)；

CEAS is content extraction access control structure, R is generator of G, s is system partial key, c [ i ]]_i∈nA set of commitment values for all message blocks;

the signer sends the original message and the signature of the original message to the signer who extracted the signcryption.

Images