CN104079412A - Trusted PKG-free threshold proxy signature method based on identity safety of smart power grid - Google Patents

Abstract

Provided is a trusted PKG-free threshold proxy signature method based on the identity safety of a smart power grid. According to the signature method, a signer interacts with a PKG and then obtains a private key pair (xid, yid) and a public key pair (Xid, Yid) of the PKG; proxy signers are authorized according to a verifiable secret sharing scheme, and it is supposed that P1, P2, ... , Pt are the t proxy signers, the t proxy signers will cooperate to generate a proxy signature of a message m; each proxy signer Pi generates a proxy signature part and sends the proxy signature part to a verifier C, and if all the proxy signature parts pass verification, the C combines the proxy signature parts into a valid threshold proxy signature. The method has higher execution efficiency due to many steps of precomputation and guarantees the security features of privacy, proxy protection, unforgeability, non-repudiation, strong identifiability and the like of the valid threshold proxy signature.

Description

The threshold proxy signature method without credible PKG based on intelligent grid identity security

Technical field

The present invention relates to intelligent grid secure data communication technical field, be specifically related to a kind of threshold proxy signature method without credible PKG based on intelligent grid identity security.

Background technology

Along with the development of mechanics of communication and information technology, various information systems are widely used in field of power as dispatch automated system, distribution automation system, electric substation automation system and technical support system for power market etc.The development in wisdom city makes intelligent grid that the telecommunications network with traditional, broadcasting and television network, the Internet etc. are organically blended, and electrical network is not only carrier and the platform of electric power transfer, and is important public service infrastructure.Rely on abundant electrical network Internet resources, build open public network service platform, impel flow of power, information flow, Business Stream constantly to merge, to meet day by day diversified user's request.

The information security issue of smart electric grid system becomes increasingly conspicuous, and the anti-attack that utilizes modern password algorithm and cipher protocol to improve electric power system application layer control protocol is one of research topic of current extensive concern.Allograph refers to the mandate through original signer, and proxy signers could represent that original signer generates effectively signature.Threshold Signature is mainly used in to be distributed to signature power in each member's the occasion of group by the mode of thresholding, Threshold Signature is introduced in proxy signature, has formed threshold proxy signature.In (t, n) threshold proxy signature, the proxy signers cooperation that is only no less than t could represent that original signer generates effectively signature.

In the cryptographic system based on identity, user's PKI directly obtains from its identity information, private key is to be called private key generating center (PKG by one, private key generator) trusted party generates, there is key escrow in the threshold proxy signature based on identity, after PKG is captured, can bring on a disaster to system.In smart electric grid system research based on identity without credible PKG technology, can prevent hostile signature, abuse allograph power problem, solve key escrow, realize authority Decentralization, therefore have important practical significance.

Summary of the invention

The object of the invention is to provide a kind of threshold proxy signature method without credible PKG based on intelligent grid identity security.After the signer of this endorsement method and PKG are mutual, obtain its private key to ( x _id , y _id ) and PKI to ( x _id , y _id ); With verifying that secret sharing scheme authorizes proxy signer, suppose P ₁, P ₂..., P _t be tindividual proxy signers, their generation message that will jointly cooperate mallograph; Each succedaneum P _i generating portion allograph, and send it to verifier C, if each part allograph passes through checking, C synthesizes an effective threshold proxy signature.

It is as follows that the present invention realizes the technical scheme that above-mentioned purpose takes: a kind of threshold proxy signature method without credible PKG based on intelligent grid identity security, exists private key generating center PKG, original signer P in supposing the system ₀, proxy signers L={P ₁, P ₂..., P _nan and verifier C, C is also a member in set L, C is responsible for verifying the validity of agent group member's personal agent signature, and these effective personal agents signatures are synthesized to allograph, establishes g ₁be by pthe circled addition group who generates, its rank are prime number q; g ₂to there is phase same order qmultiplication loop group; Bilinear map e: g ₁* g ₁→ g ₂; Concrete steps are as described below;

Step 1, system initialization: PKG chooses an integer at random s _pKG ∈ , calculate system PKI q _pKG =s _pKG p, and select following strong collisionless hash function h ₁: { 0,1} ^* → G ₁, h ₂: { 0,1} ^* → ; Then PKG will s _pKG as system private key, preserve, and open parameters={ g ₁, g ₂, e, p, q, q _pKG , h ₁, h ₂;

Step 2, key generate: supposition idthe only discernible identity that represents signer, PKG carries out physical characterization to it and be sure of idthere is uniqueness; Signer is chosen arbitrarily x _id ∈ as its first's private key, then calculate x _id =x _id p, and send x _id give PKG; PKG calculates y _id =s _pKG y _id , wherein y _id =H ₁( id, x), and will y _id send to signer, then signer obtain its private key to ( x _id , y _id ) and PKI to ( x _id , y _id ); According to above algorithm, original signer P ₀obtain private key ( x ₀, y ₀) and PKI ( x ₀, y ₀), proxy signers P _i obtain private key ( x _i , y _i ) and PKI ( x _i , y _i );

Step 3, proxy signature key generate: at proxy signature key, generate in agreement, utilize Pederson can verify that secret sharing scheme authorizes proxy signer; Original signer P ₀utilize signature scheme to certificate m _w sign, certificate m _w many matters of having described agency, comprising:

Step 3.1, original signer P ₀select first arbitrarily k ₀ ∈ , then calculate , v ₀= h ₂( m _w , r ₀) finally calculate u ₀= x ₀ v ₀ y ₀+ v ₀ y ₀so P ₀will ( m _w , r ₀) send to P _i ;

Step 3.2, original signer P ₀select arbitrarily f _i ∈ g ₁, wherein 1≤ i≤ t-1, and structure multinomial

f( x)= u ₀+ xF ₁+ ... + x ^t-1 f _t-1p ₀calculate d _i =F( i) ( i=0 ..., n), wherein d ₀ =F (0)=U ₀; Last P ₀will d _i secret sends to proxy signers P _i ( i=1 ..., n), and broadcast a ₀= e( u ₀, p), a _j = e( f _j , p), wherein j=1 ..., t-1;

Step 3.3, each P _i by following formula, verify d _i validity:

if this formula is set up, P _i calculate its proxy signature key d _i =v ₀ ( x _i q _pKG + y _i ) + w _i d _i , wherein , otherwise P _i request resends an effective value;

Step 4, allograph generate: without loss of generality, we suppose P ₁, P ₂..., P _t be tindividual proxy signers, their generation message that will jointly cooperate mallograph; Each succedaneum P _i generating portion allograph, and send it to verifier C, if each part allograph passes through checking, C synthesizes an effective threshold proxy signature, comprising:

Step 4.1, proxy signers P _i select first arbitrarily k _i ∈ , then calculate , and will r _i send to C;

Step 4.2, verifier C calculate , h=H ₂( m‖ r), and will hsend to each proxy signers P _i ;

Step 4.3, proxy signers P _i calculating section allograph u _i =hd _i + k _i p, and signature result is sent to C;

Step 4.4, verifier C receive u _i after, by following formula, verify:

If all u _i all passed through checking, C calculates , final allograph be ( u, m, m _w , r ₀ , r);

Step 5, allograph checking: threshold proxy signature verifier calculates v ₀= h ₂( m _w , r ₀), h=H ₂( m‖ r), and check whether following formula is set up:

If above formula is set up, by checking, otherwise failure.

The present invention's application has following Fundamentals of Mathematics:

If g ₁be by pthe circled addition group who generates, its rank are prime number q; g ₂to there is phase same order qmultiplication loop group; Bilinearity is to referring to the mapping with following characteristic e: g ₁* g ₁→ g ₂;

Bilinearity: e( aP, bQ) =e( p, q) ^ab , to all p, q∈ g ₁with all ;

Non-degeneracy: exist p, q∈ g ₁make, e( p, q) ≠ 1;

Computability: exist efficient algorithm to calculate e( p, q), to all p, q∈ g ₁; Circled addition group g ₁can get super unusual elliptic curve or hyperelliptic curve in finite field, bilinearity to can with the Weil on super unusual elliptic curve to or through transformation Tate to constructing.

The present invention has the following advantages: the new threshold proxy signature method without credible PKG based on identity has many precomputations, has higher execution efficiency.We use paexpression is to computing, g ₁ arepresent g ₁in add operation, g ₁ mrepresent g ₁in point multiplication operation; With g ₂ mrepresent g ₂in multiplying, use g ₂ erepresent g ₂in exponent arithmetic.Its amount of calculation in signature process is 2 g ₁ m; And only need 1 in proof procedure pa+ 1 g ₂ e.

The present invention possesses the security features such as confidentiality, agent protection, unforgeable, non-repudiation and strong identifiability of threshold proxy signature, is specially:

Confidentiality: assailant can not calculate original signer P in this programme ₀private key ( x ₀, y ₀).Under discrete logarithm is difficult to resolve, only from system PKI q _pKG in to obtain s _pKG be impossible, thereby assailant can not calculate P ₀part private key y ₀.Even if assailant combines t proxy signers conspiracy attack, he also only can calculate group allograph private key u ₀, the private key of original signer is appointed so and is maintained secrecy.

Agent protection: original signer P ₀can not get the allograph of proxy signers u _i =hd _i + k _i p, because P _i proxy signature key d _i by P _i private key ( x _i , y _i ) calculate, so new departure meets agent protection.

Unforgeable: be under the hypothesis of difficult problem at CDHP, the endorsement method that proxy signature key generates in agreement can be resisted the existential forgery under adaptability selection message attack and identity attack under random oracle model.

Non-repudiation: proxy signer P _i once produce allograph u _i , they can not deny produced allograph, because its proxy signature key d _i only have of him to know.And verifier must use the PKI of proxy signer in proof procedure, thereby they can not deny the signature that oneself produces; Same original signer can not be denied the legitimate signature of oneself.

Strong identifiability: complete effective allograph has the certificate of original signer mandate m _w so anyone can determine the identity of corresponding proxy signer from this certificate.

Embodiment

, in supposing the system, there is private key generating center PKG, original signer P in the threshold proxy signature method without credible PKG based on intelligent grid identity provided by the invention ₀, proxy signers L={P ₁, P ₂..., P _nan and verifier C, C is a member in set L, C is responsible for verifying the validity of agent group member's personal agent signature, and these effective personal agents signatures are synthesized to allograph, establishes g ₁be by pthe circled addition group who generates, its rank are prime number q; g ₂to there is phase same order qmultiplication loop group; Bilinear map e: g ₁* g ₁→ g ₂; Concrete steps are as described below;

Step 1, system initialization: PKG chooses an integer at random s _pKG ∈ , calculate system PKI q _pKG =s _pKG p, and select following strong collisionless hash function h ₁: { 0,1} ^* → G ₁, h ₂: { 0,1} ^* → ; Then PKG will s _pKG as system private key, preserve, and open parameters={ g ₁, g ₂, e, p, q, q _pKG , h ₁, h ₂;

Step 2, key generate: supposition idthe only discernible identity that represents signer, PKG carries out physical characterization to it and be sure of idthere is uniqueness; Signer is chosen arbitrarily x _id ∈ as its first's private key, then calculate x _id =x _id p, and send x _id give PKG; PKG calculates y _id =s _pKG y _id , wherein y _id =H ₁( id, x), and will y _id send to signer, then signer obtain its private key to ( x _id , y _id ) and PKI to ( x _id , y _id ); According to above algorithm, original signer P ₀obtain private key ( x ₀, y ₀) and PKI ( x ₀, y ₀), proxy signers P _i obtain private key ( x _i , y _i ) and PKI ( x _i , y _i );

Step 3, proxy signature key generate: at proxy signature key, generate in agreement, utilize Pederson can verify that secret sharing scheme authorizes proxy signer; Original signer P ₀utilize signature scheme to certificate m _w sign, certificate m _w many matters of having described agency, comprising:

Step 3.1, original signer P ₀select first arbitrarily k ₀ ∈ , then calculate , v ₀= h ₂( m _w , r ₀) finally calculate u ₀= x ₀ v ₀ y ₀+ v ₀ y ₀so P ₀will ( m _w , r ₀) send to P _i ;

Step 3.2, original signer P ₀select arbitrarily f _i ∈ g ₁, wherein 1≤ i≤ t-1, and structure multinomial

f( x)= u ₀+ xF ₁+ ... + x ^t-1 f _t-1p ₀calculate d _i =F( i) ( i=0 ..., n), wherein d ₀ =F (0)=U ₀.Last P ₀will d _i secret sends to proxy signers P _i ( i=1 ..., n), and broadcast a ₀= e( u ₀, p), a _j = e( f _j , p), wherein j=1 ..., t-1;

Step 3.3, each P _i by following formula, verify d _i validity:

if this formula is set up, P _i calculate its proxy signature key d _i =v ₀ ( x _i q _pKG + y _i ) + w _i d _i , wherein , otherwise P _i request resends an effective value;

Step 4, allograph generate: without loss of generality, we suppose P ₁, P ₂..., P _t be tindividual proxy signers, their generation message that will jointly cooperate mallograph; Each succedaneum P _i generating portion allograph, and send it to verifier C, if each part allograph passes through checking, C synthesizes an effective threshold proxy signature, comprising:

Step 4.1, proxy signers P _i select first arbitrarily k _i ∈ , then calculate , and will r _i send to C;

Step 4.2, verifier C calculate , h=H ₂( m‖ r), and will hsend to each proxy signers P _i ;

Step 4.3, proxy signers P _i calculating section allograph u _i =hd _i + k _i p, and signature result is sent to C;

Step 4.4, verifier C receive u _i after, by following formula, verify:

If all u _i all passed through checking, C calculates , final allograph be ( u, m, m _w , r ₀ , r);

Step 5, allograph checking: threshold proxy signature verifier calculates v ₀= h ₂( m _w , r ₀), h=H ₂( m‖ r), and check whether following formula is set up:

If above formula is set up, by checking, otherwise failure.

Claims (1)

1. the threshold proxy signature method without credible PKG based on intelligent grid identity security, is characterized in that existing in supposing the system private key generating center PKG, original signer P ₀, proxy signers L={P ₁, P ₂..., P _nan and verifier C, C is also a member in set L, C is responsible for verifying the validity of agent group member's personal agent signature, and these effective personal agents signatures are synthesized to allograph, establishes g ₁be by pthe circled addition group who generates, its rank are prime number q; g ₂to there is phase same order qmultiplication loop group; Bilinear map e: g ₁* g ₁→ g ₂; Concrete steps are as follows;

Step 1, system initialization: PKG chooses an integer at random s _pKG ∈ , calculate system PKI q _pKG =s _pKG p, and select following strong collisionless hash function h ₁: { 0,1} ^* → G ₁, h ₂: { 0,1} ^* → ; Then PKG will s _pKG as system private key, preserve, and open parameters={ g ₁, g ₂, e, p, q, q _pKG , h ₁, h ₂;

Step 2, key generate: supposition idthe only discernible identity that represents signer, PKG carries out physical characterization to it and be sure of idthere is uniqueness; Signer is chosen arbitrarily x _id ∈ as its first's private key, then calculate x _id =x _id p, and send x _id give PKG; PKG calculates y _id =s _pKG y _id , wherein y _id =H ₁( id, x), and will y _id send to signer, then signer obtain its private key to ( x _id , y _id ) and PKI to ( x _id , y _id ); According to above algorithm, original signer P ₀obtain private key ( x ₀, y ₀) and PKI ( x ₀, y ₀), proxy signers P _i obtain private key ( x _i , y _i ) and PKI ( x _i , y _i );

Step 3, proxy signature key generate: at proxy signature key, generate in agreement, utilize Pederson can verify that secret sharing scheme authorizes proxy signer; Original signer P ₀utilize signature scheme to certificate m _w sign, certificate m _w many matters of having described agency, comprising:

Step 3.1, original signer P ₀select first arbitrarily k ₀ ∈ , then calculate , v ₀= h ₂( m _w , r ₀) finally calculate u ₀= x ₀ v ₀ y ₀+ v ₀ y ₀so P ₀will ( m _w , r ₀) send to P _i ;

Step 3.2, original signer P ₀select arbitrarily f _i ∈ g ₁, wherein 1≤ i≤ t-1, and structure multinomial

f( x)= u ₀+ xF ₁+ ... + x ^t-1 f _t-1p ₀calculate d _i =F( i) ( i=0 ..., n), wherein d ₀ =F (0)=U ₀;

Last P ₀will d _i secret sends to proxy signers P _i ( i=1 ..., n), and broadcast a ₀= e( u ₀, p), a _j = e( f _j , p), wherein j=1 ..., t-1;

Step 3.3, each P _i by following formula, verify d _i validity:

if this formula is set up, P _i calculate its proxy signature key d _i =v ₀ ( x _i q _pKG + y _i ) + w _i d _i , wherein , otherwise P _i request resends an effective value;

Step 4, allograph generate: without loss of generality, we suppose P ₁, P ₂..., P _t be tindividual proxy signers, their generation message that will jointly cooperate mallograph; Each succedaneum P _i generating portion allograph, and send it to verifier C, if each part allograph passes through checking, C synthesizes an effective threshold proxy signature, comprising:

Step 4.1, proxy signers P _i select first arbitrarily k _i ∈ , then calculate , and will r _i send to C;

Step 4.2, verifier C calculate , h=H ₂( m‖ r), and will hsend to each proxy signers P _i ;

Step 4.3, proxy signers P _i calculating section allograph u _i =hd _i + k _i p, and signature result is sent to C;

Step 4.4, verifier C receive u _i after, by following formula, verify:

If all u _i all passed through checking, C calculates , final allograph be ( u, m, m _w , r ₀ , r);

Step 5, allograph checking: threshold proxy signature verifier calculates v ₀= h ₂( m _w , r ₀), h=H ₂( m‖ r), and check whether following formula is set up:

If above formula is set up, by checking, otherwise failure.