CN102694654B - Identity-based threshold ring signcryption method - Google Patents

Abstract

An identity-based threshold ring signcryption method includes (1) system establishment, (2) private key extraction, (3) signcryption, and (4) signcryption decryption under a standard model. The method of the invention is constructed under the standard model, and compared with the scheme designed under the random oracle model, the security is better.

Description

Identity-based Threshold Ring Signcryption Method

technical field

The invention relates to a ring signcryption method, in particular to an identity-based threshold ring signcryption method.

Background technique

In the traditional public key cryptosystem, an important issue is the authenticity of the public key. Generally speaking, in order to apply public key cryptography algorithms in the real world, there needs to be a mechanism that can verify the connection between a certain public key and a certain subject's identity at any time. The usual method is to establish a public key infrastructure, and bind the public key with the user's identity through the public key digital certificate issued by its certification center. In such systems based on public key digital certificates, before using the user's public key, people need to obtain the user's public key digital certificate and verify the correctness and legitimacy of the certificate. This requires a larger storage space to store the public key certificates of different users, and also requires more time overhead to verify the user's public key certificates. This is the shortcoming that the traditional public key cryptosystem is difficult to overcome.

In order to solve the problem of huge public key certificate storage and verification overhead in traditional public key cryptography, in 1984 Shamir creatively proposed the idea of identity-based public key cryptography. In the identity-based public key cryptosystem, the user's public key can be information that can identify the user's identity, such as E-mail, ID number, etc., and the user's private key is generated by a trusted third party based on the user's identity information. The identity-based cryptographic system enables any two users to communicate securely. The user's public key and user identity are naturally bound together. There is no need for a public key certificate or an online third party. Only a trusted key is required. It is enough for the key distribution center to issue a private key for each user who accesses the system for the first time. It solves the insurmountable shortcomings of traditional public key cryptography, and because of its own characteristics, it has a wide range of applications.

Due to the advantages of identity-based cryptography, many identity-based cryptographic systems have been introduced, and the identity-based signcryption system is one of them. At the same time, the signcryption system can also be combined with some cryptographic techniques with special properties to construct a signcryption system with special properties, such as combining the ring signcryption scheme with the secret sharing scheme to obtain identity-based threshold ring signcryption.

Bilinear pairing is an important tool for studying algebraic geometry, and it is also an important tool for constructing identity-based cryptosystems. It plays a very important role in the field of cryptography.

In addition, for identity-based public-key cryptosystems, the random oracle model is currently a relatively easy-to-use proof method. However, for the security proof based on the random oracle model, it is necessary to assume that the cryptographic hash function used in the public key cryptosystem has the security properties of the random oracle machine, but the security cryptographic scheme under the random oracle model is not necessarily safe in the actual environment , and the security proof based on the standard model only depends on the difficulty of the trapdoor one-way function contained in the public key cryptosystem. Therefore, constructing an identity-based threshold ring signcryption scheme under the standard model has both high security and practical significance, and it is an urgent problem to be solved.

In view of this, the present invention is proposed.

Contents of the invention

The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art and provide an identity-based threshold ring signcryption method that is more secure than the scheme designed under the random oracle model.

In order to solve the problems of the technologies described above, the present invention adopts the basic idea of technical solution to be:

An identity-based threshold ring signcryption method, characterized in that: comprising the following steps:

(1) System establishment: randomly select parameters, generate system parameters and corresponding master keys, where system parameters are public parameters, and the specific steps are:

Let G, G _T be a cyclic group whose order is a prime number p, e: G×G→G _T is a bilinear map, two collision-free hash functions $h_u:{\left\{\mathrm{0,1}\right\}}^{*}\&Right\; Arrow;{\left\{\mathrm{0,1}\right\}}^{{\mathrm{no}}_u}$ and $h_m:{\left\{\mathrm{0,1}\right\}}^{*}\&Right\; Arrow;{\left\{\mathrm{0,1}\right\}}^{{\mathrm{no}}_m}$ Output the identity ID and message m of any length into bit strings with lengths n _u and n _m respectively;

The trusted third party randomly selects the parameter α∈Z _p , generates the element g∈G, and calculates g ₁ =g ^a . Randomly select parameters g ₂ , u', m'∈G, n _u- dimensional vector n _m- dimensional vector where u _i ,m _i ∈ _R G, then the system parameters are $\mathrm{param}=(G,G_T,e,g,g_1,g_2,u^{\′},\hat{u},m^{\′},\hat{m},h_u,h_m),$ The master key is $\mathrm{msk}=g_2^a.$

(2) Private key extraction: input the system parameters, master key and user identity, and obtain the private key of the user identity. The specific steps are:

Given a user ID, a bit string representing the user identity with a length of n _u is obtained by calculating the hash function u=H _u (ID), let u[i] represent the i-th bit in the bit string, and define the bit string in the bit string The serial number set Φ _ID whose value is 1;

Randomly select the parameter r _u ∈ Z _p , and calculate the private key whose user identity is ID

${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\underset{{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; .</span>$

(3) Signcryption: Given a set L of n members in the threshold ring signcryption = {ID ₁ ,...,ID _n }, the identities of the t signcryptors who actually perform signcryption are subscripted as {1, 2,...,t}, the message to be signed encrypted m, the identity ID _R of the sign encrypted receiver, the specific steps of sign encrypted are:

Each signcrypter ID _i (i=1 _, ...,t) randomly selects its sub-secret s _i ∈ Z _p , and constructs a t-1 degree polynomial f _i (x)=a _i,0 + a _i,1 x+…+a _i,t-1 x ^t-1 , where s _i =a _i,0 ; then the signcrypter ID _i calculates the public parameters $C_{i,d}=g^{a_{i,d}}(d=\mathrm{0,1},..,t-1)$ and broadcast to other signcrypters;

Calculate the secret shares si _,j = f _i (j) of other signcryptor ID _j (j≠i), and send them to other signcryptor ID _j (j=1,2,...,t; j≠i), keep s _i,i ＝f _i (i);

After each other signcryptor ID _j (j=1,2,...,t; j≠i) obtains the secret share si _,j from the i-th signcryptor ID _i , use the following equation to verify its validity: After confirming that the secret sharing is valid, each signcryptor ID _i calculates its private secret according to the secret sharing as

According to the ring member identity list L={ID ₁ ,...,ID _n }, t signcryptors, the message m to be signedcrypted, and the private keys of t signcryptors, and the identity ID _R of the ring signcryptor receiver, we can obtain In the (t, n) threshold ring signcryption C under the message m to be signed encrypted, (t, n) indicates that the total number of members in the threshold ring signcryption is n, t is the threshold value, and the members who actually participate in generating the threshold ring signcryption Number ≥ t, the specific steps are:

Let m∈G _T be the message to be signcrypted, the threshold ring signcryptor randomly selects l ₁ ,...,l _n ∈ Z _p , and calculates $u_i=u^{\&prime;}\underset{{j\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_i}}{\mathrm{\&Pi;}}{\hat{u}}_j,i=1,...,\mathrm{no},R_1={\mathrm{\&sigma;}}_{16}{g}^{l_1},...,R_t={\mathrm{\&sigma;}}_{t6}{g}^{l_t},R_{t+1}=g^{l_{t+1}},...,R_{\mathrm{no}}=g^{l_{\mathrm{no}}}.$ make ${\mathrm{\&sigma;}}_1={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i1}\&CenterDot;m,$ ${\mathrm{\&sigma;}}_2={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i2},{\mathrm{\&sigma;}}_3={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i3},{\mathrm{\&sigma;}}_4={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i4}\&Center\; Dot;\underset{i=1}{\overset{\mathrm{no}}{\mathrm{\&Pi;}}}{\left(u_i\right)}^{l_i},{\mathrm{\&sigma;}}_5={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i5},$ Then the generated threshold ring signcryption is C=(σ ₁ ,...σ ₅ ,R ₁ ,...R _n ).

(4) Signcryption decryption: Calculate the message according to the threshold ring signcryption and the private key of the ring signcryption recipient ID _R , and bring the obtained message to the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&CenterDot;\&CenterDot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ , if and only if the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the obtained threshold ring signcryption is invalid and the obtained message is wrong, return to step (1).

Preferably, after obtaining the private secret in the step (3) signcryption, perform the following steps to obtain the threshold ring signcryption:

For i∈{1,2,...,t}, let the private key of each signcrypter ID _i be (d _i1 ,d _i2 ), calculate M=H _m (L,m), let is the set of sequence number k with M[k]=1 in the bit string of message m, randomly select r _i ∈ Z _p , and calculate partial threshold ring signcryption ${\mathrm{\&sigma;}}_{i1}=e{(g_1,g_2)}^{r_i},{\mathrm{\&sigma;}}_{i2}=g^{r_i},{\mathrm{\&sigma;}}_{i3}={\left(u^{\&prime;}\underset{{j\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_R}}{\mathrm{\&Pi;}}{\hat{u}}_j\right)}^{r_i},{\mathrm{\&sigma;}}_{i4}=d_{i1}{\left(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{\hat{m}}_i\right)}^{x_i{\mathrm{\&eta;}}_i},{\mathrm{\&sigma;}}_{i5}=g^{x_i{\mathrm{\&eta;}}_i},$ σ _i6 ＝d _i2 , and send (σ _i1 ,σ _i2 ,σ _i3 ,σ _i4 ,σ _i5 ,σ _i6 ) to any one of the t signcryptors to generate threshold ring signcryption, where ${\mathrm{\&eta;}}_i={\mathrm{\&Pi;}}_{j=1,j\&NotEqual;i}^t\frac{j}{j-i}\mathrm{mod}p$ is the Lagrange coefficient.

Preferably, the specific steps of the described deciphering are as follows:

After receiving the threshold ring signcryption, the recipient of the threshold ring signcryption uses its private key to first calculate the message m to be signedcrypted, m=σ ₁ ·e(d _R2 ,σ ₃ )·e(d _R1 ,σ ₂ ) ^-1 , and then calculate the bit string of the message to be signed encrypted with a length of n _m through the hash function, and define the serial number set M whose value is 1 in the bit string;

Substitute the message into the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&CenterDot;\&Center\; Dot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ In , if and only when the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the threshold ring signcryption obtained is invalid and the obtained message is wrong.

After adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art: the method of the present invention is constructed under the standard model, and compared with the scheme designed under the random oracle model, the security is better.

The specific implementation manners of the present invention will be further described in detail below in conjunction with the accompanying drawings.

Description of drawings

Fig. 1 is a basic flow chart of the present invention;

Figure 2 is the protocol from attacking the threshold signcryption algorithm to solving the DBDH problem;

Figure 3 is the protocol from falsifying threshold signcryption to solving the CDH problem.

Detailed ways

As shown in Figure 1, an identity-based threshold ring signcryption method includes the following steps:

S1. System establishment: randomly select parameters, generate system parameters and corresponding master keys, where system parameters are public parameters, and the specific steps are:

Let G, G _T be a cyclic group whose order is a prime number p, e: G×G→G _T is a bilinear map, two collision-free hash functions $h_u:{\left\{\mathrm{0,1}\right\}}^{*}\&Right\; Arrow;{\left\{\mathrm{0,1}\right\}}^{{\mathrm{no}}_u}$ and $h_m:{\left\{\mathrm{0,1}\right\}}^{*}\&Right\; Arrow;{\left\{\mathrm{0,1}\right\}}^{{\mathrm{no}}_m}$ Output the identity ID and message m of any length into bit strings with lengths n _u and n _m respectively;

The trusted third party randomly selects the parameter α∈Z _p , generates the element g∈G, and calculates g ₁ =g ^a . Randomly select parameters g ₂ , u', m'∈G, n _u- dimensional vector n _m- dimensional vector where u _i ,m _i ∈ _R G, then the system parameters are $\mathrm{param}=(G,G_T,e,g,g_1,g_2,u^{\&prime;},\hat{u},m^{\&prime;},\hat{m},h_u,h_m),$ The master key is $\mathrm{msk}=g_2^a;$

S2. Private key extraction: input the system parameters, master key and user identity, and obtain the private key of the user identity. The specific steps are:

Given a user ID, a bit string representing the user identity with a length of n _u is obtained by calculating the hash function u=H _u (ID), let u[i] represent the i-th bit in the bit string, and define the bit string in the bit string The serial number set Φ _ID whose value is 1;

Randomly select the parameter r _u ∈ Z _p , and calculate the private key whose user identity is ID

${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\underset{{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ;</span>$

Here, the serial number set Φ _ID is used in the calculation of the private key. For d ₁ in the formula, that is here is n _u- dimensional vector, u _i is the corresponding serial number in the set Φ _ID corresponding elements in .

S3. Signcryption: Given a set L of n members in the threshold ring signcryption = {ID ₁ ,...,ID _n }, the identities of the t signcryptors who actually perform signcryption are subscripted as {1,2 ,...,t}, the message to be signed encrypted m, the identity ID _R of the sign encrypted receiver, the specific steps of sign encrypted are:

Each signcrypter ID _i (i=1 _, ...,t) randomly selects its sub-secret s _i ∈ Z _p , and constructs a t-1 degree polynomial f _i (x)=a _i,0 + a _i,1 x+…+a _i,t-1 x ^t-1 , where s _i =a _i,0 ; then the signcrypter ID _i calculates the public parameters And broadcast to other signcrypters; (Z _p represents the remaining group of integer modulo p, which is a general representation in cryptography)

Calculate the secret shares si _,j = f _i (j) of other signcryptor ID _j (j≠i), and send them to other signcryptor ID _j (j=1,2,...,t; j≠i), keep s _i,i ＝f _i (i);

After the signcrypter ID _j (j=1,2,..,t; j≠i) gets the secret share si _,j from the signcrypter ID _i , use the following equation to verify its validity: After confirming that the secret sharing is valid, each signcryptor ID _i calculates its private secret according to the secret sharing as Each signcrypter ID _i is all the signcryptors that received the secret share. For example, suppose there are t signcryptors here, let their numbers be 1,...,t. Now signcrypter 1 needs to calculate the secret share to the rest of the signcryptors. In the same way, each of the remaining signcryptors also needs to calculate the secret share from t-1 other signcryptors. Therefore, each The signcryptors are the t signcrypters here.

According to the ring member identity list L={ID ₁ ,...,ID _n }, t signcryptors, the message m to be signedcrypted, and the private keys of t signcryptors, and the identity ID _R of the ring signcryptor receiver, we can obtain In the (t,n) threshold ring signcryption C under the message m to be signed encrypted, (t,n) is the total number of members in the threshold ring signcryption is n, t is the threshold value, and the members who actually participate in the generation of the threshold ring signcryption Number ≥ t, this expression is used when expressing the threshold. The specific steps are:

Let m∈G _T be the message to be signcrypted, the threshold ring signcryptor randomly selects l ₁ ,...,l _n ∈ Z _p , and calculates $u_i=u^{\&prime;}\underset{{j\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_i}}{\mathrm{\&Pi;}}{\hat{u}}_j,i=1,...,\mathrm{no},R_1={\mathrm{\&sigma;}}_{16}{g}^{l_1},...,R_t={\mathrm{\&sigma;}}_{t6}{g}^{l_t},R_{t+1}=g^{l_{t+1}},...,R_{\mathrm{no}}=g^{l_{\mathrm{no}}}.$ make ${\mathrm{\&sigma;}}_1={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i1}\&Center\; Dot;m,$ ${\mathrm{\&sigma;}}_2={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i2},{\mathrm{\&sigma;}}_3={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i3},{\mathrm{\&sigma;}}_4={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i4}\&Center\; Dot;\underset{i=1}{\overset{\mathrm{no}}{\mathrm{\&Pi;}}}{\left(u_i\right)}^{l_i},{\mathrm{\&sigma;}}_5={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i5},$ Then the generated threshold ring signcryption is C=(σ ₁ ,...σ ₅ ,R ₁ ,...R _n );

S4. Signcryption decryption: Calculate the message according to the threshold ring signcryption and the private key of the ring signcryption recipient ID _R , and bring the obtained message to the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&Center\; Dot;\&Center\; Dot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ In , if and only when the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the threshold ring signcryption obtained is invalid and the obtained message is wrong.

Preferably, after the private secret is obtained in the step S3 signcryption, the following steps are performed to obtain the threshold ring signcryption:

For i∈{1,2,...,t}, let the private key of each signcrypter ID _i be (d _i1 ,d _i2 ), calculate M=H _m (L,m), let is the set of sequence number k with M[k]=1 in the bit string of message m, randomly select r _i ∈ Z _p , and calculate partial threshold ring signcryption ${\mathrm{\&sigma;}}_{i1}=e{(g_1,g_2)}^{r_i},{\mathrm{\&sigma;}}_{i2}=g^{r_i},{\mathrm{\&sigma;}}_{i3}={\left(u^{\&prime;}\underset{{j\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_R}}{\mathrm{\&Pi;}}{\hat{u}}_j\right)}^{r_i},{\mathrm{\&sigma;}}_{i4}=d_{i1}{\left(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{\hat{m}}_i\right)}^{x_i{\mathrm{\&eta;}}_i},{\mathrm{\&sigma;}}_{i5}=g^{x_i{\mathrm{\&eta;}}_i},$ σ _i6 ＝d _i2 , and send (σ _i1 ,σ _i2 ,σ _i3 ,σ _i4 ,σ _i5 ,σ _i6 ) to any one of the t signcryptors to generate threshold ring signcryption, where ${\mathrm{\&eta;}}_i={\mathrm{\&Pi;}}_{j=1,j\&NotEqual;i}^t\frac{j}{j-i}\mathrm{mod}p$ is the Lagrange coefficient.

Preferably, the specific steps of the described deciphering are as follows:

After receiving the threshold ring signcryption, the recipient of the threshold ring signcryption uses its private key to first calculate the message m to be signedcrypted, m=σ ₁ ·e(d _R2 ,σ ₃ )·e(d _R1 ,σ ₂ ) ^-1 , and then calculate the bit string of the message to be signed encrypted with a length of n _m through the hash function, and define the serial number set M whose value is 1 in the bit string;

Substitute the message into the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&Center\; Dot;\&Center\; Dot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ In , if and only when the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the threshold ring signcryption obtained is invalid and the obtained message is wrong.

M is used here for verification, for here is an n _m- dimensional vector, m _i is the corresponding sequence number in the set M corresponding elements in .

The indistinguishable security proof of the present invention is shown in Figure 2, and the specific implementation steps are:

1. Assuming that adversary A can attack this scheme with a non-negligible advantage, algorithm B can be constructed, and B can use A to solve the DBDH problem. Given B an instance of the DBDH problem (g, g ^a , g ^b , g ^c , h), its goal is to judge whether h = e(g, g) ^abc , and B imitates A's challenger.

2. Algorithm B sets l _u = 2(q _e + q _s ), l _m = 2q _s , where q _e is the number of A private key queries, and q _s is the number of A signcryption queries. Randomly select k _u and k _m , satisfying 0≤k _u ≤n _u and 0≤k _m ≤n _m , and assuming l _u (n _u +1)<p and l _m (n _m +1)<p. Choice B and a vector X=( _xi ) of length n _u , where choose and a vector Z=(z _k ) of length n _m , where Finally, B chooses y', w'∈ _R Z _p , the vector Y=(y _i ) with length n _u , and the vector W=(w _i ) with length n _m , where y _i , w _i ∈ _R Z _p . For the membership ID in L and the bit string u=H _u (ID) and M=H _m (L,m) of the message m, the following functions are defined:

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; ID</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; x</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; l</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}{\mathrm{<span\; class="notranslate">\; k</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; J</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; ID</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}$

$\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; z</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; z</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; l</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; k</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; L</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; w</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; +</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}$

Algorithm B constructs the public parameters in the scheme of the present invention as follows:

g ₁ = g ^a , g ₂ = g ^b ; $u^{\&prime;}=g_2^{{-l}_u{k}_u+x^{\&prime;}}{g}^{{\mathrm{the\; y}}^{\&prime;}},u_i=g_2^{x_i}{g}^{{\mathrm{the\; y}}_i},1\&le;i\&le;{\mathrm{no}}_u;m^{\&prime;}=g_2^{-l_m{k}_m+z^{\&prime;}}{g}^{w^{\&prime;}},m_i=g_2^{z_i}{g}^{w_i},$ $1\&le;i\&le;{\mathrm{no}}_m;$ Algorithm B then sends the public parameters to Adversary A.

3. In the first stage, when adversary A initiates a certain number of queries, algorithm B responds as follows:

(1) Private key query: When adversary A asks for the private key of ID, although algorithm B does not know the master key, assuming F(ID)≠0 mod p, B can also construct its private key d _ID . B choose r _u ∈ Z _p and calculate:

$d_{\mathrm{ID}}=(d_1,d_2)=(g_1^{-J\left(\mathrm{ID}\right)/f\left(\mathrm{ID}\right)}{\left(u^{\&prime;}\underset{{i\&Element;\mathrm{\&Phi;}}_{\mathrm{ID}}}{\mathrm{\&Pi;}}{u}_i\right)}^{r_u},g_1^{-1/f\left(\mathrm{ID}\right)}{g}^{r_u}),$ If F(ID)=0 mod p, the above calculation cannot be performed, and B will fail and exit.

(2) Signcryption query: When the adversary A queries the member identity of the ring as L={ID ₁ ,...,ID _n }, the threshold value is t(t<n), the message is m, and the actual signcryptor is ID When _i (i=1,...t) and the recipient of the ring signcryption is the threshold ring signcryption of ID _R , algorithm B first calculates M=H _m (L,m), and then outputs the threshold ring signcryption according to the following steps :

① Algorithm B randomly selects s,a ₀ ,a ₁ ,...,a _t-1 ∈ Z _p , and constructs a polynomial f(x)=a ₀ +a ₁ x+...+a t-1 with _{degree t-1} x ^t-1 , where s=a ₀ .

②Assuming that for the actual signcrypter ID _i (i=1,...t), F(ID _i )≠0 mod p is satisfied, then Algorithm B constructs their private keys according to the method in the private key query, and calculates the The private secret x _i =f(i) of the cryptographer ID _i (i=1,...t), and then use the signcryption algorithm to generate the corresponding threshold ring signcryption C.

③ If the condition F(ID _i )≠0 mod p, i=1,...t is not established, then the algorithm B can also construct the threshold ring signcryption like the method of constructing the private key in the private key query. Assuming K(M)≠0 mod p, Algorithm B randomly selects r,r ₁ ,...,r _n ,r _m ∈ Z _p , and calculates:

σ ₁ =e(g ₁ ,g ₂ ) ^r m, σ ₂ =g ^r , ${\mathrm{\&sigma;}}_3={\left(u^{\&prime;}\underset{j{\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_R}}{\mathrm{\&Pi;}}{\hat{u}}_j\right)}^r,$ ${\mathrm{\&sigma;}}_4=\left(\underset{i=1}{\overset{\mathrm{no}}{\mathrm{\&Pi;}}}{\left(u_i\right)}^{r_i}\right)g_1^{-\mathrm{tL}\left(m\right)/K\left(m\right)}{\left(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i\right)}^{r_m},{\mathrm{\&sigma;}}_5=g^{r_m},R_1=g^{r_1},...,R_{\mathrm{no}}=g^{r_{\mathrm{no}}},$ in If K(M)=0 mod p, the above calculation cannot be performed, and B will fail and exit.

(3) Signcryption query: When adversary A initiates a signcryption query under the ring member list L, the ring signcryption receiver’s identity is ID _R , and the ciphertext C, algorithm B first runs the private key extraction algorithm to obtain ID _R private key of Then run the decryption signcryption algorithm, if C is a valid ciphertext, output m, otherwise, output false.

4. In the challenge phase, adversary A randomly takes two messages m ₀ and m ₁ of the same length, and lists the ring members and the identity of the ring signcryption receiver sent to Algorithm B. If A asked in the first stage private key, B will fail and exit. B chooses one bit b∈{0,1}, if K(M _b )≠0 mod p, Then B will fail and exit. If there are no t identities ID ^* in L ^* , satisfying F(ID ^* ) ≠ 0 mod p, then B will fail to exit; otherwise, for the convenience of description, it is advisable to set the t identities as B randomly selects r,r ₁ ,...,r _n ,r _m ∈ Z _P , and the structure is as follows:

${\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; 3</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; cJ</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; R</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\underset{{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}_{{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; R</span>}}^{<span\; class="notranslate">\; *</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; u</span>}}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; c</span>}}<span\; class="notranslate">\; ,</span>$

${\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; 4</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\frac{<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; J</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; J</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; J</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; L</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; 5</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; m</span>}}}<span\; class="notranslate">\; ,</span>$

${\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; r</span>}}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}<span\; class="notranslate">\; ,</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\stackrel{<span\; class="notranslate">\; ~</span>}{\mathrm{<span\; class="notranslate">\; r</span>}}}_{\mathrm{<span\; class="notranslate">\; t</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}<span\; class="notranslate">\; ,</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}^{<span\; class="notranslate">\; *</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}}<span\; class="notranslate">\; ,</span>$

in If h=e(g,g) ^abc , it can be known that C ^* is an effective threshold ring signcryption.

5. In the second stage, adversary A can issue a certain number of private key queries, signcryption queries, and decryption queries as in phase 1, but A cannot query The private key and the decryption signcryption query to C ^* .

6. In the guessing phase, adversary A outputs a guess b' of b. If b=b', then B outputs 1, taking h=e(g,g) ^abc as the solution to the DBDH problem; otherwise, B outputs 0, and terminates the game.

Therefore, if there exists an adversary that can attack CCA2 with non-negligible probability, then there exists an efficient algorithm that can solve DBDH with non-negligible probability, and this contradicts that DBDH is a hard problem, so the solution is IND-IDTRSC -CCA2 safe.

The proof of the unforgeable security of the present invention is shown in Figure 3, and the specific implementation steps are:

1. Assuming that counterfeiter A can attack this scheme with a non-negligible advantage, he can construct algorithm B, and B can use A to solve the CDH problem. Given B an instance of a CDH problem (g, g ^a , g ^b ), the goal is to compute g ^ab , where B imitates A's challenger.

2. Algorithm B constructs the same system public parameters as in the previous proof, and then sends it to adversary A.

3. Adversary A can adaptively initiate a certain number of private key queries, signcryption queries, and signcryption decryption queries as in the previous proof.

4. In the forgery stage, the adversary A outputs the list of members in the ring The threshold t, the message m ^* and the identity of the receiver of the ring signcryption are Forged Threshold Ring Signcryption under C ^* . If Algorithm B does not fail to exit during the entire process, Algorithm B checks whether the following conditions hold:

① It is true for all i∈(1,...,n);

②K(M ^* )＝0 mod p, where M ^* ＝ _Hm (L,m ^* ).

If the above conditions are not satisfied at the same time, then algorithm B will fail and exit; otherwise, B can calculate ${\left(\frac{{\mathrm{\&sigma;}}_4^{*}}{{R_1}^{J\left({\mathrm{ID}}_l^{*}\right)}\&CenterDot;\&Center\; Dot;\&Center\; Dot;{R_{\mathrm{no}}}^{J\left({\mathrm{ID}}_{\mathrm{no}}^{*}\right)}{R_m}^{L\left(m^{*}\right)}}\right)}^{1/t}={\left(\frac{g_2^{\mathrm{ta}}{\left(u^{\&prime;}\underset{{i\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_i^{*}}}{\mathrm{\&Pi;}}{u}_i\right)}^{r_1}\&CenterDot;\&Center\; Dot;\&CenterDot;{\left(u^{\&prime;}\underset{{i\&Element;\mathrm{\&Phi;}}_{{\mathrm{ID}}_{\mathrm{no}}^{*}}}{\mathrm{\&Pi;}}{u}_i\right)}^{r_i}{\left(m^{\&prime;}\underset{k\&Element;m}{\mathrm{\&Pi;}}{m}_j\right)}^{r_m}}{g^{J\left({\mathrm{ID}}_1^{*}\right)r_1}\&CenterDot;\&CenterDot;\&CenterDot;g^{J\left({\mathrm{ID}}_{\mathrm{no}}^{*}\right)r_{\mathrm{no}}}{g}^{L\left(m^{*}\right)r_m}}\right)}^{1/t}={\left(g_2^{\mathrm{ta}}\right)}^{1/t}=g_2^a=g^{\mathrm{ab}}$

This is the solution to the CDH problem.

Therefore, if there exists an adversary who can forge a valid threshold-ring signcryption with non-negligible probability, then there exists an algorithm that can solve the CDH problem with non-negligible probability, which contradicts that the CDH problem is a hard problem, so the scheme is EUF-IDTRSC-CMIA safe.

In summary, according to the present invention, a new approach and new method for constructing an identity-threshold ring signcryption scheme based on a standard model has been realized, and the security reliability of the scheme has been shown through specific scheme security proofs. The realization of the method not only It has both theoretical and practical significance.

It can be seen from the above that the present invention is constructed under the standard model, and the method is proved to be indistinguishable and unforgeable through experiments, so this method has better security than the scheme designed under the random oracle model .

The above is only a preferred embodiment of the present invention, it should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications are also It should be regarded as the protection scope of the present invention.

Claims (2)

1. a threshold ring signcryption method based on identity, it is characterized in that: comprise the following steps: (1) System establishment: randomly select parameters, generate system parameters and corresponding master keys, where system parameters are public parameters, and the specific steps are: Let G, G _T be a cyclic group whose order is a prime number p, e: G×G→G _T is a bilinear map, two collision-free hash functions and Output the identity ID and message m of any length into bit strings with lengths n _u and n _m respectively; A trusted third party randomly selects parameters α∈Z _p , generator g∈G, and calculates g ₁ =g ^a ; randomly selects parameters g ₂ , u',m'∈G, n _u- dimensional vector n _m- dimensional vector where u _i ,m _i ∈ _R G, then the system parameters are $\mathrm{param}=(G,G_T,e,g,g_1,g_2,u^{\&prime;},\hat{u},m^{\&prime;},\hat{m},h_u,h_m),$ The master key is $\mathrm{msk}=g_2^a;$ (2) Private key extraction: input the system parameters, master key and user identity, and obtain the private key of the user identity. The specific steps are: Given a user ID, a bit string representing the user identity with a length of n _u is obtained by calculating the hash function u=H _u (ID), let u[i] represent the i-th bit in the bit string, and define the bit string in the bit string The serial number set Φ _ID whose value is 1; Randomly select the parameter r _u ∈ Z _p , and calculate the private key whose user identity is ID ${\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; \&Phi;</span>}}_{\mathrm{<span\; class="notranslate">\; ID</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; u</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ;</span>$ (3) Signcryption: Given a set L of n members in the threshold ring signcryption = {ID ₁ ,...,ID _n }, the identities of the t signcryptors who actually perform signcryption are subscripted as {1, 2,...,t}, the message to be signed encrypted m, the identity ID _R of the sign encrypted receiver, the specific steps of sign encrypted are: Each signcrypter ID _i (i=1 _, ...,t) randomly selects its sub-secret s _i ∈ Z _p , and constructs a t-1 degree polynomial f _i (x)=a _i,0 + a _i,1 x+…+a _i,t-1 x ^t-1 , where s _i =a _i,0 ; then the signcrypter ID _i calculates the public parameters Where d=0,1,...,t-1, and broadcast to other signcryptors; Calculate the secret share si _,j =f i (j) of other signcryptor ID _j (j=1,2,..,t; _j ≠i), and send them to other signcryptor ID _j ( j＝1,2,..,t; j≠i), keep s _i,i ＝f _i (i); After each other signcryptor ID _j (j=1,2,...,t; j≠i) obtains the secret share si _,j from the i-th signcryptor ID _i , use the following equation to verify its validity: After confirming that the secret sharing is valid, each signcryptor ID _i calculates its private secret according to the secret sharing as According to the ring member identity list L={ID ₁ ,...,ID _n }, t signcryptors, the message m to be signedcrypted, and the private keys of t signcryptors, and the identity ID _R of the ring signcryptor receiver, we can obtain In the (t, n) threshold ring signcryption C under the message m to be signed encrypted, (t, n) indicates that the total number of members in the threshold ring signcryption is n, t is the threshold value, and the members who actually participate in generating the threshold ring signcryption Number ≥ t, the specific steps are: Let m∈G _T be the message to be signcrypted, the threshold ring signcryptor randomly selects l ₁ ,...,l _n ∈ Z _p , and calculates $u_i=u^{\&prime;}\underset{j\&Element;{\mathrm{\&Phi;}}_{{\mathrm{ID}}_i}}{\mathrm{\&Pi;}}{\hat{u}}_j,$ i=1,...,n, $R_1={\mathrm{\&sigma;}}_{16}{g}^{l_1},...,R_t={\mathrm{\&sigma;}}_{t6}{g}^{l_t},R_{t+1}=g^{l_{t+1}},...,R_{\mathrm{no}}=g^{l_{\mathrm{no}}};$ make ${\mathrm{\&sigma;}}_1={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i1}\&CenterDot;m,$ ${\mathrm{\&sigma;}}_2={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i2},$ ${\mathrm{\&sigma;}}_3={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i3},$ ${\mathrm{\&sigma;}}_4={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i4}\&CenterDot;\underset{i=1}{\overset{\mathrm{no}}{\mathrm{\&Pi;}}}{\left(u_i\right)}^{l_i},$ ${\mathrm{\&sigma;}}_5={\mathrm{\&Pi;}}_{i=1}^t{\mathrm{\&sigma;}}_{i5},$ Then the generated threshold ring signcryption is C=(σ ₁ ,...σ ₅ ,R ₁ ,...R _n ); (4) Signcryption decryption: Calculate the message according to the threshold ring signcryption and the private key of the ring signcryption recipient ID _R , and bring the obtained message to the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&Center\; Dot;\&Center\; Dot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ , if and only when the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the obtained threshold ring signcryption is invalid and the obtained message is wrong, return to step (1); After the private secret is obtained in the step (3) signcryption, the following steps are performed to obtain the threshold ring signcryption: For i∈{1,2,...,t}, let the private key of each signcrypter ID _i be (d _i1 ,d _i2 ), calculate M=H _m (L,m), let is the set of sequence number k with M[k]=1 in the bit string of message m, randomly select r _i ∈ Z _p , and calculate partial threshold ring signcryption ${\mathrm{\&sigma;}}_{i1}=e{(g_1,g_2)}^{r_i},$ ${\mathrm{\&sigma;}}_{i2}=r^{r_i},{\mathrm{\&sigma;}}_{i3}={\left(u^{\&prime;}\underset{j\&Element;{\mathrm{\&Phi;}}_{{\mathrm{ID}}_R}}{\mathrm{\&Pi;}}{\hat{u}}_j\right)}^{r_i},$ ${\mathrm{\&sigma;}}_{i4}=d_{i1}{\left(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{\hat{m}}_i\right)}^{x_i{\mathrm{\&eta;}}_i},$ ${\mathrm{\&sigma;}}_{i5}=g^{x_i{\mathrm{\&eta;}}_i},$ σ _i6 ＝d _i2 , and send (σ _i1 ,σ _i2 ,σ _i3 ,σ _i4 ,σ _i5 ,σ _i6 ) to any one of the t signcryptors to generate threshold ring signcryption, where is the Lagrange coefficient. 2. The identity-based threshold ring signcryption method according to claim 1, characterized in that: the concrete steps of deciphering the signcryption are as follows: After receiving the threshold ring signcryption, the recipient of the threshold ring signcryption uses its private key to first calculate the message m to be signedcrypted, m=σ ₁ ·e(d _R2 ,σ ₃ )·e(d _R1 ,σ ₂ ) ^-1 , and then calculate the bit string of the message to be signed encrypted with a length of n _m through the hash function, and define the serial number set M whose value is 1 in the bit string; Substitute the message into the formula $e({\mathrm{\&sigma;}}_4,g)=e{(g_1,g_2)}^{t}e(u_1,R_1)\&Center\; Dot;\&Center\; Dot;\&Center\; Dot;e(u_{\mathrm{no}},R_{\mathrm{no}})e(m^{\&prime;}\underset{i\&Element;m}{\mathrm{\&Pi;}}{m}_i,{\mathrm{\&sigma;}}_5)$ In , if and only when the equation holds, the threshold ring signcryption is valid and the obtained message is correct, otherwise the threshold ring signcryption obtained is invalid and the obtained message is wrong.