CN104079412B - The threshold proxy signature method without credible PKG based on intelligent grid identity security - Google Patents

Abstract

A kind of threshold proxy signature method without credible PKG based on intelligent grid identity security.The endorsement method signer and PKG interaction after obtain its private key to (x _id ,y _id ) and public key to (X _id ,Y _id )；Proxy signer is authorized with Verified secret sharing scheme, it is assumed that P₁,P₂,…,P _t It istIndividual proxy signerses, they will cooperate jointly produces messagemAllograph；Each succedaneum P _i Generating unit subagent signs, and sends it to verifier C, if each part allograph synthesizes an effective threshold proxy signature by checking, C.Tool method of the present invention has many precomputations, has higher execution efficiency.Possess the security features such as confidentiality, agent protection, unforgeable, non-repudiation and the strong identifiability of threshold proxy signature.

Description

Threshold proxy signature method without credible PKG (public key generator) based on identity security of intelligent power grid

Technical Field

The invention relates to the technical field of intelligent power grid safety data communication, in particular to a threshold proxy signature method of an untrusted PKG (public key generator) based on intelligent power grid identity safety.

Background

With the development of communication technology and information technology, various information systems such as a dispatching automation system, a distribution network automation system, a substation automation system, an electric power market technology support system and the like are widely applied to the field of electric power systems. The development of smart cities enables smart power grids to be organically integrated with traditional telecommunication networks, broadcast networks, internet and the like, and the power grids are not only carriers and platforms for power transmission, but also important public service infrastructures. An open public network service platform is constructed by relying on abundant power grid network resources, so that power flow, information flow and business flow are promoted to be fused continuously, and increasingly diversified user requirements are met.

The information security problem of the smart grid system is increasingly outstanding, and the improvement of the attack resistance of the control protocol of the application layer of the power system by using the modern cryptographic algorithm and the cryptographic protocol is one of the research subjects which are widely concerned at present. Proxy signing refers to the authorization of an original signer to generate a valid signature on behalf of the original signer. The threshold signature is mainly applied to the occasion that the signature authority is distributed to each member of the group in a threshold mode, and the threshold signature is introduced into an agent signature system to form the threshold agent signature. In the (t, n) threshold proxy signature, only no less than t proxy signers cooperate to generate a valid signature on behalf of the original signer.

In an identity-based cryptosystem, a public key of a user is directly obtained from identity information of the user, a private key is generated by a trusted party called a Private Key Generator (PKG), a key escrow problem exists in identity-based threshold proxy signatures, and a disaster is brought to the system after the PKG is compromised. The identity-based untrusted PKG technology is researched in an intelligent power grid system, the problems of malicious signature and abuse of proxy signature rights can be prevented, key escrow is solved, and distributed authority management is achieved, so that the method has important practical significance.

Disclosure of Invention

The invention aims to provide a threshold proxy signature method without a trusted PKG based on intelligent power grid identity security. The signer of the signature method is handed over with PKGMutually obtain its private key pair: (x _id , y _id ) And a public key pair (X _id , Y _id ) (ii) a Authorizing proxy signers with verifiable secret sharing scheme, assuming P ₁ ,P ₂ ,…,P _t Is thattIndividual agent signers who will collaborate together to generate a messagemThe proxy signature of (2); each agent P _i Partial proxy signatures are generated and sent to verifier C, which synthesizes a valid threshold proxy signature if each partial proxy signature passes verification.

The technical scheme adopted by the invention for realizing the purpose is as follows: a threshold proxy signature method without credible PKG based on identity security of a smart grid is provided, wherein a private key generation center PKG and an original signer P are assumed to exist in a system ₀ Proxy signer L = { P = { (P) ₁ ,P ₂ ,…,P _n And a verifier C and C which are also one member of the set L and are responsible for verifying the validity of the personal proxy signatures of the proxy group members and synthesizing the valid personal proxy signatures into a proxy signatureG ₁ Is composed ofPGenerating cyclic addition groups of prime orderq；G ₂ Are of the same orderqA multiplication loop group of (1); bilinear mappinge：G ₁ ×G ₁ →G ₂ (ii) a The specific steps are as follows;

step 1, system initialization: PKG randomly selects an integers _PKG ∈Calculating the system public keyQ _PKG =s _PKG PAnd selecting the following strong collision-free hash functionH ₁ :{0,1} ^* →G ₁ ，H ₂ :{0,1} ^* → (ii) a Then the PKG wills _PKG Preservation as a system private keyAnd discloseparameters={G ₁ ,G ₂ ,e,P,q,Q _PKG ,H ₁ ,H ₂ }；

Step 2, key generation: suppose thatidRepresenting a uniquely identifiable identity of the signer for whom the PKG is physically confidentidHas uniqueness; optional selection by signerx _id ∈As its first part private key, and then calculatesX _id =x _id PAnd transmitX _id Feeding the PKG; calculation of PKGy _id =s _PKG Y _id In whichY _id = H ₁ (id, X) And will bey _id Is sent to the signer, whereupon the signer obtains its private key pair: (x _id , y _id ) And a public key pair (X _id , Y _id ) (ii) a According to the above algorithm, the original signer P ₀ Obtaining the private key (x ₀ ,y ₀ ) And the public key (X ₀ , Y ₀ ) Proxy signer P _i Obtaining the private key (x _i , y _i ) And the public key ( X _i , Y _i )；

Step 3, generating an agent key: in the proxy key generation protocol, a Pederson verifiable secret sharing scheme is utilized to authorize a proxy signer; original signer P ₀ Verification of a certificate using a signature schemem _w Carry out signature and certificatem _w A number of matters are described for an agent, including:

step 3.1, original signer P ₀ First, arbitrarily selectk ₀ ∈Then calculate，v ₀ =H ₂ (m _w ,r ₀ ) Finally calculate outU ₀ =x ₀ v ₀ Y ₀ +v ₀ y ₀ Thus P ₀ Will (a) tom _w ,r ₀ ) Is sent to P _i ；

Step 3.2, original signer P ₀ Arbitrarily selectF _i ∈G ₁ Wherein 1 is less than or equal toi≤ t-1, and constructing a polynomial

F(x)=U ₀ +xF ₁ +…+x ^t-1 F _t-1 P ₀ Calculating outD _i =F(i)(i=0,…,n) WhereinD ₀ =F(0)=U ₀ (ii) a Last P ₀ Will be provided withD _i Secret sending to proxy signer P _i (i=1,…,n) And broadcastA ₀ =e(U ₀ ,P), A _j =e(F _j ,P) In whichj=1,…,t-1；

Step 3.3, each P _i Verified by the following formulaD _i The effectiveness of (2):

if the formula is true, P _i Computing its proxy signing keyd _i = v ₀ (x _i Q _PKG +y _i )+w _i D _i WhereinElse P _i Requesting a valid value to be resent;

and 4, generating an agent signature: without loss of generality, we assume P ₁ ,P ₂ ,…,P _t Is thattIndividual agent signers who will collaborate together to generate a messagemThe proxy signature of (3); each agent P _i Generating and sending partial proxy signatures to a verifier C, which synthesizes a valid threshold proxy signature if each partial proxy signature passes the verification, including:

step 4.1, proxy signer P _i First, arbitrarily selectk _i ∈Then calculateAnd will ber _i Sending the data to C;

step 4.2, verifier C calculates，h=H ₂ (m‖r) And will behSent to each proxy signer P _i ；

Step 4.3, proxy signer P _i Computing partial proxy signaturesU _i =hd _i +k _i PAnd sending the signature result to C;

step 4.4, verifier C receivesU _i Then, it was verified by the following formula:

if all ofU _i All pass the verification, C calculatesFinally, finallyThe proxy signature of (A) isU, m, m _w ,r ₀ , r)；

Step 5, proxy signature verification: threshold proxy signature verifier computationv ₀ =H ₂ (m _w , r ₀ )、h=H ₂ (m‖r) And checks whether the following equation holds:

if the above formula is true, the verification is passed, otherwise the verification fails.

The application of the invention has the following mathematical basis:

is provided withG ₁ Is formed byPGenerating cyclic addition groups of prime orderq；G ₂ Are of the same orderqA multiplication loop group of (1); bilinear pairings refer to mappings with the following propertiese：G ₁ ×G ₁ →G ₂ ；

Bilinear:e(aP,bQ)=e(P,Q) ^ab to all ofP,Q∈G ₁ And all of；

Non-degradability: exist ofP,Q∈G ₁ So that the position of the first and second end faces,e(P,Q)≠1；

calculability: there is an efficient algorithm to computee(P,Q) To all ofP,Q∈G ₁ (ii) a Cyclic addition groupG ₁ The supersingular elliptic curve or the supersingular elliptic curve in a finite field can be taken, and the bilinear pair can be constructed by Weil pair or modified Tate pair on the supersingular elliptic curve.

The invention has the following advantages: the novel identity-based threshold proxy signature method without the trusted PKG has a plurality of precomputations and higher executionEfficiency. We usePaIt is shown that for the operation of the pair,G ₁ Ato representG ₁ The addition operation in (2) is performed,G ₁ Mto representG ₁ Dot product operation in (1); by usingG ₂ MRepresentG ₂ By multiplication inG ₂ ERepresentG ₂ The exponential operation in (1). The calculated amount in the signature process is 2G ₁ M(ii) a And only 1 is needed in the verification processPa+1G ₂ E。

The invention has the security characteristics of threshold proxy signature, such as confidentiality, proxy protectiveness, non-forgeability, non-repudiation, strong identifiability and the like, and specifically comprises the following steps:

confidentiality: in the scheme, an attacker cannot calculate an original signer P ₀ Is/are as follows private key (x ₀ ,y ₀ ). Under discrete logarithm difficult to solve, only from system public keyQ _PKG To obtains _PKG Is impossible, so that it is impossible for an attacker to calculate P ₀ Part of the private key ofy ₀ . Even if an attacker combines t proxy signers to collude and attack, the attacker can only calculate the private key of the group proxy signatureU ₀ The private key of the original signer is, of course, kept secret.

And (3) proxy protection: original signer P ₀ Proxy signatures for proxy signers are not availableU _i =hd _i +k _i PDue to P _i Proxy signing key ofd _i Is formed by P _i Private key of (1: (x _i ,y _i ) Calculated, the new solution thus satisfies the agent protectiveness.

Non-forgeability: under the assumption that CDHP is a difficult problem, a signature method in a proxy key generation protocol can resist adaptive selective message attack and presence forgery under identity attack under a random predictive model.

Non-repudiation: proxy signer P _i Once the proxy signature is generatedU _i They will not be able to repudiate the generated proxy signature because of their proxy signature keyd _i Only one of them knows. And the verifier must use the public key of the proxy signer during the verification process, so they cannot deny the signature generated by themselves; also the original signer cannot deny his own legal signature.

Strong identifiability: fully effective proxy signing of certificates authorized by original signersm _w Anyone can then determine the identity of the corresponding proxy signer from the certificate.

Detailed Description

The invention provides a threshold proxy signature method of a credible PKG (public key generator) based on the identity of an intelligent power grid, and an original signer P (public key generator) and a private key generation center (PKG) are assumed to exist in a system ₀ Proxy signer L = { P = ₁ ,P ₂ ,…,P _n And a verifier C, C is a member of the set L and is responsible for verifying the validity of the personal proxy signatures of the proxy group members and synthesizing the valid personal proxy signatures into a proxy signatureG ₁ Is composed ofPGenerating cyclic addition groups of which the order is primeq；G ₂ Are of the same orderqA multiplication cycle group of (2); bilinear mappinge：G ₁ ×G ₁ →G ₂ (ii) a The specific steps are as follows;

step 1, system initialization: PKG randomly selects an integers _PKG ∈Calculating the system public keyQ _PKG =s _PKG PAnd selecting the following strong collision-free hash functionH ₁ :{0,1} ^* →G ₁ ，H ₂ :{0,1} ^* → (ii) a However, the device is not suitable for use in a kitchenpost-PKG wills _PKG Stored as a system private key and disclosedparameters={G ₁ ,G ₂ ,e,P,q,Q _PKG ,H ₁ ,H ₂ }；

Step 2, generating a key: suppose thatidRepresenting a uniquely identifiable identity of the signer for whom the PKG is physically confidentidHas uniqueness; optional selection by signerx _id ∈As its first part of the private key, and then calculatesX _id =x _id PAnd transmitX _id Feeding PKG; PKG calculationy _id =s _PKG Y _id WhereinY _id = H ₁ (id, X) And will bey _id Is sent to the signer, who then obtains its private key pair (x _id , y _id ) And a public key pair (X _id , Y _id ) (ii) a According to the above algorithm, the original signer P ₀ Obtaining the private key (x ₀ ,y ₀ ) And the public key (X ₀ , Y ₀ ) Proxy signer P _i Obtaining the private key (x _i , y _i ) And the public key ( X _i , Y _i )；

Step 3, generating an agent key: in the proxy key generation protocol, a Pederson verifiable secret sharing scheme is utilized to authorize proxy signers; original signer P ₀ Verification of a certificate using a signature schemem _w Carry out signature and certificatem _w A number of matters are described for an agent, including:

step 3.1, original signer P ₀ First, arbitrarily selectk ₀ ∈Then calculate，v ₀ =H ₂ (m _w ,r ₀ ) Finally calculate outU ₀ =x ₀ v ₀ Y ₀ +v ₀ y ₀ Thus P ₀ Will (a) tom _w ,r ₀ ) Is sent to P _i ；

Step 3.2, original signer P ₀ Arbitrarily selectF _i ∈G ₁ Wherein 1 is less than or equal toi≤ t-1 and constructing a polynomial

F(x)=U ₀ +xF ₁ +…+x ^t-1 F _t-1 P ₀ ComputingD _i =F(i)(i=0,…,n) WhereinD ₀ =F(0)=U ₀ . Last P ₀ Will be provided withD _i Secret sending to proxy signer P _i (i=1,…,n) And broadcastA ₀ =e(U ₀ ,P), A _j =e(F _j ,P) Whereinj=1,…,t-1；

Step 3.3 Each P _i Verified by the following formulaD _i The effectiveness of (2):

if this formula holds true, P _i Computing its proxy signing keyd _i = v ₀ (x _i Q _PKG +y _i )+w _i D _i In whichOtherwise P _i Requesting a valid value to be resent;

and 4, generating an agent signature: without loss of generality, we assume P ₁ ,P ₂ ,…,P _t Is thattIndividual agent signers who will collaborate together to generate a messagemThe proxy signature of (2); each agent P _i Generating partial proxy signatures and sending them to verifier C, and if each partial proxy signature passes the verification, C synthesizing a valid threshold proxy signature, comprising:

step 4.1, proxy signer P _i First, arbitrarily selectk _i ∈Then calculateAnd will ber _i Sending the data to C;

step 4.2, verifier C calculates，h=H ₂ (m‖r) And will behSent to each proxy signer P _i ；

Step 4.3, proxy signer P _i Computing partial proxy signaturesU _i =hd _i +k _i PAnd sending the signature result to C;

step 4.4, verifier C receivesU _i Thereafter, it was verified by the following formula:

if all ofU _i All pass the verification, then C calculatesThe final proxy signature isU, m, m _w ,r ₀ , r)；

Step 5, proxy signature verification: threshold proxy signature verifier computationv ₀ =H ₂ (m _w , r ₀ )、h=H ₂ (m‖r) And checking whether the following formula holds:

if the above formula is true, the verification is passed, otherwise the verification fails.

Claims (1)

1. A threshold proxy signature method without a credible PKG based on identity security of a smart power grid is characterized in that a private key generation center PKG and an original signer P exist in an assumed system ₀ A set of proxy signers L = { P = { (P) ₁ ,P ₂ ,…,P _n A verifier C, C is also a member of the set L, C is responsible for verifying the validity of the personal proxy signature of the proxy group member; at least t proxy signers in the set L generate partial proxy signatures (n, t are integers, and n is more than or equal to t&gt, 1) and sending it to a verifier C, wherein if each partial proxy signature passes the verification, C synthesizes a valid threshold proxy signature; let G ₁ Is a cyclic addition group generated by P, the order of which is a prime number q; g ₂ Is a multiplication loop group of the same order q; bilinear mapping e: g ₁ ×G ₁ →G ₂ (ii) a The method comprises the following specific steps;

step 1, system initialization: PKG randomly selects an integerCalculate the system public key Q _PKG ＝s _PKG P, and select the following strong collision-free hash functionH ₁ :{0,1} ^* →G ₁ ，Then PKG will convert s _PKG Saved as system private key and public parameters = { G = ₁ ,G ₂ ,e,P,q,Q _PKG ,H ₁ ,H ₂ }；

Step 2, key generation: assuming that the id represents a uniquely identifiable identity of the signer, which the PKG physically authenticates is confident that the id is unique; optional selection by signerAs its first part of the private key, then X is calculated _id ＝x _id P, and sends X _id Feeding PKG; PKG calculates y _id ＝s _PKG Y _id Wherein Y is _id ＝H ₁ (id,X _id ) And is combined with y _id Sent to the signer, who then obtains its private key pair (x) _id ,y _id ) And a public key pair (X) _id ,Y _id ) (ii) a According to the above algorithm, the original signer P ₀ Obtain the private key (x) ₀ ,y ₀ ) And a public key (X) ₀ ,Y ₀ ) Proxy signer P _i Obtain the private key (x) _i ,y _i ) And a public key (X) _i ,Y _i )；

Step 3, generating an agent key: in the proxy key generation protocol, a Pederson verifiable secret sharing scheme is utilized to authorize proxy signers; original signer P ₀ Pairing certificates m using a signature scheme _w Carry out signature, certificate m _w A number of matters are described for an agent, including:

step 3.1, original signer P ₀ First, arbitrarily selectThen calculatev ₀ ＝H ₂ (m _w ,r ₀ ) Finally calculate U ₀ ＝x ₀ v ₀ Y ₀ +v ₀ y ₀ Thus P ₀ Will (m) _w ,r ₀ ) Is sent to P _i ；

Step 3.2, original signer P ₀ Optional selection of F _i ∈G ₁ Wherein 1 ≦ i ≦ t-1, and constructing a polynomial F (x) = U ₀ +xF ₁ +…+x ^t-1 F _t-1 ，P ₀ Calculating D _i = F (i) (i =0, \8230;, n), where D ₀ ＝F(0)＝U ₀ (ii) a Last P ₀ Will D _i Secret sending to proxy signer P _i (i =1, \ 8230;, n), and broadcasts A ₀ ＝e(U ₀ ,P),A _j ＝e(F _j P), wherein j =1, \8230;, t-1;

step 3.3 Each P _i Verification of D by the following formula _i The effectiveness of (2):wherein A is _j ＝e(F _j ,P)，If the formula holds, P _i Calculate its proxy signing key d _i ＝v ₀ (x _i Q _PKG +y _i )+w _i D _i In whichOtherwise P _i Requesting a valid value to be resent;

step 4, generating a proxy signature: without loss of generality, we assume P ₁ ,P ₂ ,…,P _t Are t proxy signers that will cooperate together to generate a proxy signature for message m; each agent P _i Generating partial proxy signatures and sending them to verifier C, and if each partial proxy signature passes the verification, C synthesizing a valid threshold proxy signature, comprising:

step 4.1, proxy signer P _i First, arbitrarily selectThen calculateAnd r is to _i Sending the data to C;

step 4.2, verifier C calculatesh＝H ₂ (m | r), and sends h to each proxy signer P _i ；

Step 4.3, proxy signer P _i Calculating partial proxy signatures U _i ＝hd _i +k _i P, and sending the signature result to C;

step 4.4, verifier C receives U _i Then, it was verified by the following formula:

if all U' s _i All pass the verification, then C calculatesThe final proxy signature is (U, m) _w ,r ₀ ,r)；

Step 5, proxy signature verification: threshold proxy signature verifier calculation v ₀ ＝H ₂ (m _w ,r ₀ )、h＝H ₂ (m | r), and checking whether the following formula holds:

if the above formula is true, the verification is passed, otherwise the verification fails.