CN111064581A - Privacy protection method and system with connection capability - Google Patents

Abstract

The invention discloses a privacy protection method and a system with connection capability.A secret key is generated firstly, and comprises a group public key, a group member release secret key and a signature secret key of a signer; then signing according to the generated key, including signing by one signer and signing by the main signer and the assistant signer together; and finally, verifying the obtained signature.

Description

Privacy protection method and system with connection capability

Technical Field

The invention belongs to the technical field of information security, and particularly relates to a privacy protection method and system with connection capability.

Background

Information security is a comprehensive discipline relating to computer technology, network technology, communication technology, number theory, finite field and other disciplines. The method mainly researches how to guarantee the confidentiality, the integrity and the non-repudiation of the information in the information transmission process so as to prevent the information from being forged, counterfeited, tampered, maliciously attacked and the like in the information transmission process.

In recent years, with the development of scientific technology, the security requirements of various countries on information are higher and higher, and the information security becomes more and more important for various aspects of a country. Network information security issues are one of the many key issues in the field of information security. How to prevent the privacy information from being illegally intercepted and modified in the network environment and even being impersonated as an identity is an important issue to be solved urgently in the field of network security.

Disclosure of Invention

The invention aims to provide a privacy protection method and a privacy protection system with connection capability, which overcome the defects of the prior art, and the method adds a connection function for an anonymous signature mechanism in the process of designing the anonymous signature mechanism, wherein the function can be used for judging whether two anonymous signatories are the same entity if necessary, and the entities include but are not limited to individuals, equipment and the like with identity information, and have wider application prospects at home and abroad.

In order to achieve the purpose, the invention adopts the following technical scheme:

a privacy protection method with connectivity capability, comprising the steps of:

step 1, generating a key, including generating a group public key, a group member issuing key and a signature key of a signer;

step 2, signing according to the key generated in the step 1, wherein the signing comprises signing by a signer and common signing by a main signer and an assistant signer;

and 3, verifying the signature generated in the step 2.

Further, the process of generating the group public key and the group member issuing key in step 1 is as follows:

step 1.1.1, select an asymmetric bilinear pair G with large prime number p₁、G₂And a corresponding bilinear function e: g₁×G₂→G_T；

Wherein G is₁And G₂An addition cycle group with an order p on the elliptic curve; g_TA multiplication loop group of order p;

step 1.1.2, select G₁Generating element P of₁Wherein P is₁：G₁A random number of (1);

step 1.1.3, select G₂Generating element P of₂Wherein P is₂：G₂A random number of (1);

step 1.1.4, select a hash function, H₁：{0，1}^*→Z_p(ii) a Wherein Z is_pRepresents [0, p-1 ]]A set of integers of (d);

step 1.1.5 from G₁Selection inRandom element Q₁、Q₂；

Step 1.1.6 from Z_p ^*Selecting a random integer y, and calculating: w ═ y]P₂Wherein Z is_p ^*Represents [1, p-1 ]]A set of integers of [ y ]]P₂For multiplication operations on elliptic curves, representing y P₂Adding;

step 1.1.7, calculating: t is₁＝e(P₁，P₂)，T₂＝e(Q₁，P₂)，T₃＝e(Q₂，P₂)，T₄＝e(Q₂W); wherein, T₁、T₂、T₃、T₄Are all G_TThe elements of (1);

step 1.1.8, output group common parameter ═ G₁、G₂、G_T、p、e、P₁、P₂、H₁、H₂) (ii) a Wherein H₂To be used for generating Z_p ^*A hash function of the element in (a);

group public key ═ (Q)₁、Q₂、W、T₁、T₂、T₃、T₄)；

The group member issues a key y.

Further, the process of generating the signing key of the signer in the step 1 is as follows:

step 1.2.1, group member publisher selects a temporary n_I∈{0，1}^t(ii) a Wherein n is_IAn integer representing a length t, t representing a security parameter;

step 1.2.2 group member publisher n_ISending the signature to the signer;

step 1.2.3 signer slave Z_p ^*Randomly selecting a member private key f;

step 1.2.4 signer slave Z_p ^*Randomly selecting an integer r;

step 1.2.5, signer calculates: f ═ F]Q₁，R＝[r]Q₁；

Step 1.2.6, signer calculates:

m₁＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)；

c＝(m₁+x_R)modp；

wherein x is_RDenotes the abscissa of the R point, m₁Representing a temporary hash value generated in a process, mod representing a modulo operation;

step 1.2.7, signer calculates: s ═ 1+ f)^-1·(r-c·f)modp；

Step 1.2.8, the signer sends (F, c, s) to the group member publishers;

step 1.2.9, group member publisher calculation:

m₂＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)

t₁＝(c+s)modp

verification t₁If equal to 0, then the verification fails and the process terminates; if not equal to 0, the verification passes, then:

R₄＝[s]Q₁+[t₁]F

c₁＝(m₂+x_R4)modp

wherein x is_R4Represents R₄Abscissa of point, m₂Representing a temporary hash value generated in a process;

step 1.2.10, group member publisher verification equation c₁If yes, continuing to execute step 1.2.11; otherwise, the verification fails and the process is terminated;

step 1.2.11, group member publisher from Z_p ^*Randomly selecting an integer x;

step 1.2.12, group member publisher calculates:

A＝[1/(x+y)](P₁+F)

step 1.2.13, the group member publisher generates a member certificate (A, x) of the signer, and sends the member certificate of the signer to the signer;

step 1.2.14, signer judges the equation e (A, W [ x ]]P₂)＝e(P₁+F，P₂) Whether to verify the member certificate in the right place, if so, continue to step 1.2.15, otherwise the process terminates;

step 1.2.15, the signer's signature key is: (f, A, x).

Further, when a signer signs a signature in step 2, the public key of the input group (Q) is equal to₁、Q₂、W、T₁、T₂、T₃、T₄) (ii) a The member signing key of the signer is (f, a, x); a linker bsn; message m belongs to {0, 1}^*The signer uses its group member signing key to perform the following steps to compute an anonymous signed message for a particular message:

step 2.1.1 from G₁Selecting a random number J;

step 2.1.2, signer calculates: k ═ f ] J;

step 2.1.3 signer slave Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp; wherein "·" represents a multiplication operation;

step 2.1.4, signer calculates: t ═ A + [ a ]]Q₂；

Step 2.1.5, signer follows Z_p ^*Randomly selecting 4 integers: r is_f、r_x、r_a、r_b；

Step 2.1.6, signer calculates: r₁＝[r_f]J；

Step 2.1.7, signer calculates:

step 2.1.8, signer calculates: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

Step 2.1.9, signer calculates: s_f＝(r_f+c·f)modp；s_x＝(r_x+c·x)modp；

Step 2.1.10, signer calculates: s_a＝(r_a+c·a)modp，s_b＝(r_b+c·b)modp；

Step 2.1.11, signer calculates:

s₁＝(1+f)^-1·(r_f-r₁·f)modp；

wherein the content of the first and second substances,

represents R₁The abscissa of the point;

step 2.1.12, the signer outputs an anonymous signature value: σ ═ of (J, K, T, c, s_f，s_x，s_a，s_b，r₁，s₁)。

Further, when the master signer and the assistant signer jointly sign in step 2, ① group public key (Q) is input₁、Q₂、W、T₁、T₂、T₃、T₄) ② signer's member signature key (f, A, x), ③ connection base bsn, ④ message m e {0, 1}^*The method comprises the following steps:

step 2.2.1, the main signer owns the private key f of the group member, and the assistant signer owns (A, x);

step 2.2.2 from G₁Selecting a random number J;

step 2.2.3, calculating by the main signer: k ═ f ] J;

step 2.2.4, Master signer Slave Z_p ^*Randomly selecting 1 integer: r is_f；

Step 2.2.5, calculating by the main signer: r₁＝[r_f]J，R_2t＝[r_f]Q₁；

Step 2.2.6, Master signer will (J, K, R)₁，R_2t) Sending to the assistant signer;

step 2.2.7, assistant signer from Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp;

step 2.2.8, Assistant signatureThe calculation is as follows: t ═ A + [ a ]]Q₂；

Step 2.2.9, Assistant signer from Z_p ^*Randomly selecting 3 integers: r is_x、r_a、r_b；

Step 2.2.10, assistant signer calculates:

step 2.2.11, the assistant signer calculates:

c_h＝H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R₁||R₂)

step 2.2.12, Assistant signer will c_hSending the signature to a main signer;

step 2.2.13, the primary signer selects a random number n_T∈{0，1}^t；

Step 2.2.14, calculation of the main signer: c is H₁(c_h||n_T||m)；

Step 2.2.15, calculation of the main signer: s_f＝(r_f+c·f)modp；

Step 2.2.16, master signer calculates:

s₂＝(1+f)^-1·(r_f-r₁·f)modp；

wherein

Represents R₁The abscissa of the point;

step 2.2.17, the master signer will (c, n)_T，s_f，r₂，s₂) Sending to the assistant signer;

step 2.2.18, the assistant signer calculates:

s_x＝(r_x+c·x)modp

s_a＝(r_a+c·a)modp

s_b＝(r_b+c·b)modp

step 2.2.19, the assistant signer outputs an anonymous signature value: σ ═ of (J, K, T, c, n_T，s_f，s_x，s_a，s_b，r₂，s₂)。

Further, when the signature obtained in step 2 is verified in step 3, a message m is input; a linker bsn; signature (J, K, T, c, n)_T，s_f，s_x，s_a，s_b，r₂，s₂) (ii) a Group public key (Q)₁、Q₂、W、T₁、T₂、T₃、T₄) The verifier performs the following steps to verify the signature:

step 3.1, verifying by a verifier: whether J, K, T are G₁The elements of (1);

step 3.2, verifying by a verifier: s_f，s_x，s_a，s_bWhether or not it is Z_pThe elements of (1);

step 3.3, if bsn is not null, the verifier verifies that equation J equals H₂(bsn) if true, continuing to step 3.4 if true, otherwise, ending the verification process; if bsn is empty, the verification process ends;

and 3.4, calculating by the verifier: r₁＝[s_f]J-[c]K；

And 3.5, calculating by the verifier:

and 3.6, calculating by the verifier: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

And 3.7, calculating by the verifier: t is t₃＝(r₂+s₂)modp；

Verification of equation t₃If yes, the verification is not passed, otherwise, the verification is passed;

and 3.8, calculating by a verifier: r₅＝[s₂]J+[t₃]K，

And verifies equation r₅＝r₂If the verification result is positive, the verification is passed, otherwise, the verification is not passed;

and 3.9, if the verification is not passed in the steps 3.7 or 3.8, outputting 0 to indicate that the signature is invalid, otherwise, outputting 1 to indicate that the signature is valid.

Further, the method further comprises the step of judging whether the two signatures are signed by the same signer, specifically: the join process inputs two signatures: σ ═ of (J, K, T, c, n_T，s_f，s_x，s_a，s_b，r₂，s₂)，σ’＝(J’，K’，T’，c’，n_T’，s_f’，s_x’，s_a’，s_b’，r₂’，s₂'), the signature joiner performs the following process to complete the connection: if J is equal to J 'and K is equal to K', outputting 1 to indicate that the connection is successful, namely that the two signatures are signed by the same signer, otherwise outputting 0 to indicate that the connection is invalid, namely that the two signatures are not signed by the same signer.

A privacy protection system with connection capability comprises a key generation module, a signature module and a verification module;

a key generation module: the group public key, the group member issuing key and the signature key of the signer are generated;

a signature module: for signing based on the generated key, including signing by one signer and common signing by a master signer and an assistant signer;

a verification module: for verifying the resulting signature.

Compared with the prior art, the invention has the following beneficial technical effects:

the parameters used in the process of generating the digital signature are completely random, and an attacker cannot calculate the identity of the signer, so that the anonymity of the signature is ensured. In addition, in the invention, except the signer, any group member including the group administrator cannot generate legal signature on the name of other people, and the invention has the capability of preventing the damage attack. The connection function provided by the invention can judge whether two signatories are the same entity or not when necessary, thereby determining the relationship between two anonymous signatures and providing an interface for supervision while protecting privacy.

Detailed Description

Embodiments of the invention are described in further detail below:

the symbols used in the present invention are as follows:

(1) p: a large prime number.

(2)G₁: an additive cyclic group with an order p on the elliptic curve.

(3)G₂: an additive cyclic group with an order p on the elliptic curve.

(4)G_T: a multiplication loop group of order p.

(5) e: bilinear function, G₁×G₂→G_T。

(6)P₁：G₁A random number of (2).

(7)P₂：G₂A random number of (2).

(8) m: a message to be signed.

(9)Z_p：[0，p-1]Is set of integers of (a).

(10)Z_p ^*：[1，p-1]Is set of integers of (a).

(11) H: a hash function.

(12) bsn: a linking group.

(13) L |: x | | Y represents the result of concatenating data items X and Y in the specified order.

(14) [ n ] P: multiplication on an elliptic curve represents n additions of P.

(15) t: a security parameter

(16)Q₁、Q₂、A、F、R、J、K、J’、K’、R₁、R_2t、R₃：G₁Of (1).

(17)W：G₂Of (1).

(18)T₁、T₂、T₃、T₄、R₂：G_TOf (1).

(19)y、f、f’、x、r、c、c₁、c_h、a、b、r_f、r_x、r_a、r_b、s_f、s_x、s_a、s_b、u、v、r_u、r_v、s_u、s_v：Z_pElement of (5), Z_pAll elements in (1) other than 0 also belong to Z_p ^*。

(20)n_I、n_V、n_T: an integer t bits long.

(21)H₁: for generating Z_pA hash function of the element in (a).

(22)H₂: for generating Z_p ^*A hash function of the element in (a).

A privacy protection method with connectivity capability, comprising the steps of:

step 1, generating a key, including generating a group public key, a group member issuing key and a signature key of a signer;

the process of generating the group public key and the group member issuing the key is as follows:

step 1.1.1, select an asymmetric bilinear pair G with large prime number p₁、G₂And a corresponding bilinear function e: g₁×G₂→G_T；

Wherein G is₁And G₂An addition cycle group with an order p on the elliptic curve; g_TA multiplication loop group of order p;

step 1.1.2, select G₁Generating element P of₁Wherein P is₁：G₁A random number of (1);

step 1.1.3, select G₂Generating element P of₂Wherein P is₂：G₂A random number of (1);

step 1.1.4, select a hash function, H₁：{0，1}^*→Z_p(ii) a Wherein Z is_pRepresents [0, p-1 ]]A set of integers of (d);

step 1.1.5 from G₁In the selection of random element Q₁、Q₂；

Step 1.1.6 from Z_p ^*Selecting a random integer y, and calculating: w ═ y]P₂Wherein Z is_p ^*Represents [1, p-1 ]]A set of integers of (d);

step 1.1.7, calculating: t is₁＝e(P₁，P₂)，T₂＝e(Q₁，P₂)，T₃＝e(Q₂，P₂)，T₄＝e(Q₂W); wherein, T₁、T₂、T₃、T₄Are all G_TThe elements of (1);

step 1.1.8, output group common parameter ═ G₁、G₂、G_T、p、e、P₁、P₂、H₁、H₂) (ii) a Wherein H₂To be used for generating Z_p ^*A hash function of the element in (a);

group public key ═ (Q)₁、Q₂、W、T₁、T₂、T₃、T₄)；

The group member issues a key y.

The process of generating the signer's signing key is as follows:

step 1.2.1, group member publisher selects a temporary n_I∈{0，1}^t(ii) a Wherein n is_IAn integer representing a length t, t representing a security parameter;

step 1.2.2 group member publisher n_ISending the signature to the signer;

step 1.2.3 signer slave Z_p ^*Randomly selecting a member private key f;

step 1.2.4 signer slave Z_p ^*Randomly selecting an integer r;

step 1.2.5, signer calculates: f ═ F]Q₁，R＝[r]Q₁；

Step 1.2.6, signer calculates:

m₁＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)；

c＝(m₁+x_R)modp；

wherein x is_RDenotes the abscissa of the R point, m₁Representing a temporary hash value generated in a process, mod representing a modulo operation;

step 1.2.7, signer calculates: s ═ 1+ f)^-1·(r-c·f)modp；

Step 1.2.8, the signer sends (F, c, s) to the group member publishers;

step 1.2.9, group member publisher calculation:

m₂＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)

t₁＝(c+s)modp

verification t₁If equal to 0, then the verification fails and the process terminates; if not equal to 0, the verification passes, then:

R₄＝[s]Q₁+[t₁]F

c₁＝(m₂+x_R4)modp

wherein x is_R4Represents R₄Abscissa of point, m₂Representing a temporary hash value generated in a process;

step 1.2.10, group member publisher verification equation c₁If yes, continuing to execute step 1.2.11; otherwise, the verification fails and the process is terminated;

step 1.2.11, group member publisher from Z_p ^*Randomly selecting an integer x;

step 1.2.12, group member publisher calculates:

A＝[1/(x+y)](P₁+F)

step 1.2.13, the group member publisher generates a member certificate (A, x) of the signer, and sends the member certificate of the signer to the signer;

step 1.2.14, signer judges the equation e (A, W [ x ]]P₂)＝e(P₁+F，P₂) Whether to verify the member certificate in the right place, if so, continue to step 1.2.15, otherwise the process terminates;

step 1.2.15, the signer's signature key is: (f, A, x).

Step 2, signing according to the key generated in the step 1, wherein the signing comprises signing by a signer and common signing by a main signer and an assistant signer;

when signed by a signer, the input group public key (Q)₁、Q₂、W、T₁、T₂、T₃、T₄) (ii) a The member signing key of the signer is (f, a, x); a linker bsn; message m belongs to {0, 1}^*The signer uses its group member signing key to perform the following steps to compute an anonymous signed message for a particular message:

step 2.1.1 from G₁Selecting a random number J;

step 2.1.2, signer calculates: k ═ f ] J;

step 2.1.3 signer slave Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp;

step 2.1.4, signer calculates: t ═ A + [ a ]]Q₂；

Step 2.1.5, signer follows Z_p ^*Randomly selecting 4 integers: r is_f、r_x、r_a、r_b；

Step 2.1.6, signer calculates: r₁＝[r_f]J；

Step 2.1.7, signer calculates:

step 2.1.8, signer calculates: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

Step 2.1.9, signer calculates: s_f＝(r_f+c·f)modp；s_x＝(r_x+c·x)modp；

Step 2.1.10, signer calculates: s_a＝(r_a+c·a)modp，s_b＝(r_b+c·b)modp；

Step 2.1.11, signer calculates:

s₁＝(1+f)^-1·(r_f-r₁·f)modp

wherein the content of the first and second substances,

represents R₁The abscissa of the point;

step 2.1.12, the signer outputs an anonymous signature value: σ ═ of (J, K, T, c, s_f，s_x，s_a，s_b，r₁，s₁)。

When signed by a signer, the input group public key (Q)₁、Q₂、W、T₁、T₂、T₃、T₄) (ii) a The member signing key of the signer is (f, a, x); a linker bsn; message m belongs to {0, 1}^*The signer uses its group member signing key to perform the following steps to compute an anonymous signed message for a particular message:

step 2.1.1 from G₁Selecting a random number J;

step 2.1.2, signer calculates: k ═ f ] J;

step 2.1.3 signer slave Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp;

step 2.1.4, signer calculates: t ═ A + [ a ]]Q₂；

Step 2.1.5, signer follows Z_p ^*Randomly selecting 4 integers: r is_f、r_x、r_a、r_b；

Step 2.1.6, signer calculates: r₁＝[r_f]J；

Step 2.1.7, signer calculates:

step 2.1.8, signer calculates: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R₁||R₂)||m)；

Step 2.1.9, signer calculates: s_f＝(r_f+c·f)modp；s_x＝(r_x+c·x)modp；

Step 2.1.10, signer calculates: s_a＝(r_a+c·a)modp，s_b＝(r_b+c·b)modp；

Step 2.1.11, signer calculates:

s₁＝(1+f)^-1·(r_f-r₁·f)modp

wherein the content of the first and second substances,

represents R₁The abscissa of the point;

step 2.1.12, the signer outputs an anonymous signature value: σ ═ of (J, K, T, c, s_f，s_x，s_a，s_b，r₁，s₁)。

Step 3, verifying the signature generated in the step 2, and inputting a message m during verification; a linker bsn; signature (J, K, T, c, n)_T，s_f，s_x，s_a，s_b，r₂，s₂) (ii) a Group public key (Q)₁、Q₂、W、T₁、T₂、T₃、T₄) The verifier performs the following steps to verify the signature:

step 3.1, verifying by a verifier: whether J, K, T are G₁The elements of (1);

step 3.2, verifying by a verifier: s_f，s_x，s_a，s_bWhether or not it is Z_pThe elements of (1);

step 3.3, if bsn is not null, the verifier verifies that equation J equals H₂(bsn) if true, continuing to step 3.4 if true, otherwise, ending the verification process; if bsn is empty, the verification process ends;

and 3.4, calculating by the verifier: r₁＝[s_f]J-[c]K；

And 3.5, calculating by the verifier:

and 3.6, calculating by the verifier: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

And 3.7, calculating by the verifier: t is t₃＝(r₂+s₂)modp；

Verification of equation t₃If yes, the verification is not passed, otherwise, the verification is passed;

and 3.8, calculating by a verifier: r₅＝[s₂]J+[t₃]K，

And verifies equation r₅＝r₂If the verification result is positive, the verification is passed, otherwise, the verification is not passed;

and 3.9, if the verification is not passed in the steps 3.7 or 3.8, outputting 0 to indicate that the signature is invalid, otherwise, outputting 1 to indicate that the signature is valid.

When it is necessary to determine whether two signatures are signed by the same signer, the following steps are specifically performed: the join process inputs two signatures: σ ═ of (J, K, T, c, n_T，s_f，s_x，s_a，s_b，_r2，s₂)，σ’＝(J’，K’，T’，c’，n_T’，s_f’，s_x’，s_a’，s_b’，r₂’，s₂'), the signature joiner performs the following process to complete the connection: if J is J 'and K is K', then output 1, meaning connected toAnd if not, outputting 0 to indicate that the connection is invalid and to indicate that the two signatures are not signed by the same signer.

The invention also provides a privacy protection system with connection capability for realizing the method, which comprises a key generation module, a signature module and a verification module;

a key generation module: the group public key, the group member issuing key and the signature key of the signer are generated;

a signature module: for signing based on the generated key, including signing by one signer and common signing by a master signer and an assistant signer;

a verification module: for verifying the resulting signature.

The anonymous signature mechanism is a basic information security technology, can provide privacy protection for entities in a network environment, and is a core technology which is most commonly used in academia and industry and is used for protecting private information. The anonymous signature mechanism can provide security guarantee for various network applications, does not expose the real identity of a user, and can judge whether two signatures are the same entity by using a special interface when required by a supervision department, so that the identity of the entity is further judged.

The technical scheme of the invention is realized by C language under a Linux system, and the total code amount is 2808 lines. When the program is running, the occupancy rate of the CPU is 12.3%, the RAM4824KB is occupied, and the ROM41320KB is occupied. The signature speed is 0.04 seconds and the signature verification speed is 0.048 seconds. The scheme of the invention is based on the elliptic curve cryptographic algorithm, has the characteristics of small key length, high safety performance and less time consumption of the whole digital signature, and has higher safety and practicability.

Claims (8)

1. A privacy protection method with connectivity capability, comprising the steps of:

step 1, generating a key, including generating a group public key, a group member issuing key and a signature key of a signer;

step 2, signing according to the key generated in the step 1, wherein the signing comprises signing by a signer and common signing by a main signer and an assistant signer;

and 3, verifying the signature generated in the step 2.

2. The privacy protection method with connection capability as claimed in claim 1, wherein the generating of the group public key and the group member issuing key in step 1 are as follows:

step 1.1.1, select an asymmetric bilinear pair G with large prime number p₁、G₂And a corresponding bilinear function e: g₁×G₂→G_T；

Wherein G is₁And G₂An addition cycle group with an order p on the elliptic curve; g_TA multiplication loop group of order p;

step 1.1.2, select G₁Generating element P of₁Wherein P is₁：G₁A random number of (1);

step 1.1.3, select G₂Generating element P of₂Wherein P is₂：G₂A random number of (1);

step 1.1.4, select a hash function, H₁：{0，1}^*→Z_p(ii) a Wherein Z is_pRepresents [0, p-1 ]]A set of integers of (d);

step 1.1.5 from G₁In the selection of random element Q₁、Q₂；

Step 1.1.6 from Z_p ^*Selecting a random integer y, and calculating: w ═ y]P₂Wherein Z is_p ^*Represents [1, p-1 ]]A set of integers of [ y ]]P₂For multiplication operations on elliptic curves, representing y P₂Adding;

step 1.1.7, calculating: t is₁＝e(P₁，P₂)，T₂＝e(Q₁，P₂)，T₃＝e(Q₂，P₂)，T₄＝e(Q₂W); wherein, T₁、T₂、T₃、T₄Are all G_TThe elements of (1);

step 1.1.8, outputting:

group common parameter (G)₁、G₂、G_T、p、e、P₁、P₂、H₁、H₂) (ii) a Wherein H₂To be used for generating Z_p ^*A hash function of the element in (a);

group public key ═ (Q)₁、Q₂、W、T₁、T₂、T₃、T₄)；

The group member issues a key y.

3. The method according to claim 2, wherein the process of generating the signing key of the signer in step 1 is as follows:

step 1.2.1, group member publisher selects a temporary n_I∈{0，1}^t(ii) a Wherein n is_IAn integer representing a length t, t representing a security parameter;

step 1.2.2 group member publisher n_ISending the signature to the signer;

step 1.2.3 signer slave Z_p ^*Randomly selecting a member private key f;

step 1.2.4 signer slave Z_p ^*Randomly selecting an integer r;

step 1.2.5, signer calculates: f ═ F]Q₁，R＝[r]Q₁；

Step 1.2.6, signer calculates:

m₁＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)；

c＝(m₁+x_R)modp；

wherein x is_RDenotes the abscissa of the R point, m₁Representing a temporary hash value generated in a process, mod representing a modulo operation;

step 1.2.7, signer calculates: s ═ 1+ f)^-1·(r-c·f)modp；

Step 1.2.8, the signer sends (F, c, s) to the group member publishers;

step 1.2.9, group member publisher calculation:

m₂＝H₁(p||P₁||P₂||Q₁||Q₂||W||F||R||n_I)

t₁＝(c+s)modp

verification t₁If equal to 0, then the verification fails and the process terminates; if not equal to 0, the verification passes, then:

R₄＝[s]Q₁+[t₁]F

c₁＝(m₂+x_R4)modp

wherein the content of the first and second substances,

represents R₄Abscissa of point, m₂Representing a temporary hash value generated in a process;

step 1.2.10, group member publisher verification equation c₁If yes, continuing to execute step 1.2.11; otherwise, the verification fails and the process is terminated;

step 1.2.11, group member publisher from Z_p ^*Randomly selecting an integer x;

step 1.2.12, group member publisher calculates:

A＝[1/(x+y)](P₁+F)

step 1.2.13, the group member publisher generates a member certificate (A, x) of the signer, and sends the member certificate of the signer to the signer;

step 1.2.14, signer judges the equation e (A, W [ x ]]P₂)＝e(P₁+F，P₂) Whether to verify the member certificate in the right place, if so, continue to step 1.2.15, otherwise the process terminates;

step 1.2.15, the signer's signature key is: (f, A, x).

4. A connectivity-capable privacy guard as claimed in claim 3The method of protection is characterized in that, when a signer signs in step 2, the input group public key (Q) is₁、Q₂、W、T₁、T₂、T₃、T₄) (ii) a The member signing key of the signer is (f, a, x); a linker bsn; message m belongs to {0, 1}^*The signer uses its group member signing key to perform the following steps to compute an anonymous signed message for a particular message:

step 2.1.1 from G₁Selecting a random number J;

step 2.1.2, signer calculates: k ═ f ] J;

step 2.1.3 signer slave Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp; wherein "·" represents a multiplication operation;

step 2.1.4, signer calculates: t ═ A + [ a ]]Q₂；

Step 2.1.5, signer follows Z_p ^*Randomly selecting 4 integers: r is_f、r_x、r_a、r_b；

Step 2.1.6, signer calculates: r₁＝[r_f]J；

Step 2.1.7, signer calculates:

step 2.1.8, signer calculates: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

Step 2.1.9, signer calculates: s_f＝(r_f+c·f)modp；s_x＝(r_x+c·x)modp；

Step 2.1.10, signer calculates: s_a＝(r_a+c·a)modp，s_b＝(r_b+c·b)modp；

Step 2.1.11, signer calculates:

s₁＝(1+f)^-1.(r_f-r₁·f)modp

wherein the content of the first and second substances,

represents R₁The abscissa of the point;

step 2.1.12, the signer outputs an anonymous signature value: σ ═ of (J, K, T, c, s_f，s_x，s_a，s_b，r₁，s₁)。

5. The method of claim 4, wherein when the master signer and the assistant signer jointly sign in step 2, ① group public key (Q) is input₁、Q₂、W、T₁、T₂、T₃、T₄) ② signer's member signature key (f, A, x), ③ connection base bsn, ④ message m e {0, 1}^*The method comprises the following steps:

step 2.2.1, the main signer owns the private key f of the group member, and the assistant signer owns (A, x);

step 2.2.2 from G₁Selecting a random number J;

step 2.2.3, calculating by the main signer: k ═ f ] J;

step 2.2.4, Master signer Slave Z_p ^*Randomly selecting 1 integer: r is_f；

Step 2.2.5, calculating by the main signer: r₁＝[r_f]J，R_2t＝[r_f]Q₁；

Step 2.2.6, Master signer will (J, K, R)₁，R_2t) Sending to the assistant signer;

step 2.2.7, assistant signer from Z_p ^*Selecting a random integer a, and calculating: b ═ (a · x) modp;

step 2.2.8, assistant signer calculates: t ═ A + [ a ]]Q₂；

Step 2.2.9, Assistant signer from Z_p ^*Randomly selecting 3 integers: r is_x、r_a、r_b；

Step 2.2.10, assistant signer calculates:

step 2.2.11, the assistant signer calculates:

c_h＝H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R₁||R₂)

step 2.2.12, Assistant signer will c_hSending the signature to a main signer;

step 2.2.13, the primary signer selects a random number n_T∈{0，1}^t；

Step 2.2.14, calculation of the main signer: c is H₁(c_h||n_T||m)；

Step 2.2.15, calculation of the main signer: s_f＝(r_f+c·f)modp；

Step 2.2.16, master signer calculates:

s₂＝(1+f)^-1.(r_f-r₁·f)modp；

wherein

Represents R₁The abscissa of the point;

step 2.2.17, the master signer will (c, n)_T，s_f，r₂，s₂) Sending to the assistant signer;

step 2.2.18, the assistant signer calculates:

s_x＝(r_x+c·x)modp

s_a＝(r_a+c·a)modp

s_b＝(r_b+c·b)modp

step 2.2.19, the assistant signer outputs an anonymous signature value: σ ═ of (J, K, T, c, n_T，s_f，s_x，s_a，s_b，r₂，s₂)。

6. The privacy protection method with the connection capability according to claim 5, wherein when the signature obtained in step 2 is verified in step 3, a message m is input; a linker bsn; signature (J, K, T, c, n)_T，s_f，s_x，s_a，s_b，r₂，s₂) (ii) a Group public key (Q)₁、Q₂、W、T₁、T₂、T₃、T₄) The verifier performs the following steps to verify the signature:

step 3.1, verifying by a verifier: whether J, K, T are G₁The elements of (1);

step 3.2, verifying by a verifier: s_f，s_x，s_a，s_bWhether or not it is Z_pThe elements of (1);

step 3.3, if bsn is not null, the verifier verifies that equation J equals H₂(bsn) if true, continuing to step 3.4 if true, otherwise, ending the verification process; if bsn is empty, the verification process ends;

and 3.4, calculating by the verifier: r₁＝[s_f]J-[c]K；

And 3.5, calculating by the verifier:

and 3.6, calculating by the verifier: c is H₁(H₁(p||P₁||P₂||Q₁||Q₂||W||J||K||T||R1||R2||m；

And 3.7, calculating by the verifier: t is t₃＝(r₂+s₂)modp；

Verification of equation t₃If yes, the verification is not passed, otherwise, the verification is passed;

and 3.8, calculating by a verifier: r₅＝[s₂]J+[t₃]K，

And verifies equation r₅＝r₂If the verification result is positive, the verification is passed, otherwise, the verification is not passed;

and 3.9, if the verification is not passed in the steps 3.7 or 3.8, outputting 0 to indicate that the signature is invalid, otherwise, outputting 1 to indicate that the signature is valid.

7. The privacy protection method with the connection capability according to claim 6, further comprising determining whether two signatures are signed by the same signer, specifically: the join process inputs two signatures: σ ═ of (J, K, T, c, n_T，s_f，s_x，s_a，s_b，r₂，s₂)，σ’＝(J’，K’，T’，c’，n_T’，s_f’，s_x’，s_a’，s_b’，r₂’，s₂'), the signature joiner performs the following process to complete the connection: if J is equal to J 'and K is equal to K', outputting 1 to indicate that the connection is successful, namely that the two signatures are signed by the same signer, otherwise outputting 0 to indicate that the connection is invalid, namely that the two signatures are not signed by the same signer.

8. A connectionless privacy protection system for implementing a connectionless privacy protection method as claimed in any one of claims 1 to 7, comprising a key generation module, a signature module and a verification module;

a key generation module: the group public key, the group member issuing key and the signature key of the signer are generated;

a signature module: for signing based on the generated key, including signing by one signer and common signing by a master signer and an assistant signer;

a verification module: for verifying the resulting signature.