CN104168115B - The undetachable digital signatures method of forward secrecy - Google Patents

Abstract

The invention discloses a forward secure inseparable digital signature method, the method includes the following algorithms: key generation algorithm KGen, key upgrade algorithm KUpd, inseparable signature method generation algorithm UndSigFunGen, inseparable signature algorithm FSUndSig, indivisible signature verification algorithm FSUndVrfy, signature algorithm Sign, verification algorithm Vrfy. The present invention can realize the forward-safe inseparable digital signature under the white-box attack environment. Throughout the scheme, mobile agents do not need to carry the private key as the digital signature they generate represents the original signature, so the private key will not be affected. The function of encryption is combined with the request of the original signer, so the misoperation of the signature algorithm can be prevented. The scheme does not need a special key distribution organization, and even if the signer is compromised, the scheme still has forward security.

Description

Forward-safe indivisible digital signature method

technical field

The invention relates to the technical field of information security, in particular to mobile security agent technology, which is applied to e-commerce, mobile computing and the like.

Background technique

As more and more mobile agent-based technologies come into practice, without suitable, secure, trusted and stealthy technologies to protect sensitive business data and allow business partners to work together with sufficient confidence, These applications are impossible to implement successfully. However, mobile agents are facing a huge security threat, and the current identity-based inseparable digital signature method in the field of mobile security agents can complete the task safely and effectively.

However, the identity-based inseparable digital signature method must require a centralized security agency that distributes keys, but in fact there are many cases where there is no such authoritative and reliable agency. Therefore, there is an urgent need for a method that does not rely on the key distribution organization, but also has high security and high reliability to protect the mobile agent.

The scheme is based on bilinear pairings. Its security depends on the difficulty of solving computational Diffie-Hellman problems in Diffie-Hellman groups. Most of the basic concepts, such as groups, rings, and fields, are standard concepts in modern algebra.

Brief description of similar technologies (products):

In order to solve the problem in the implementation of traditional electronic signature schemes in the past, when the mobile agent generates an electronic signature on behalf of the original user, it needs to carry the signature algorithm and signature key itself, which will allow the attacker to forge the signature algorithm from the agent, or even crack Security issues for signing keys. Using Kotzanikolaous, P., Burmester, M., Chrissikopoulos, V., Secure Transactions with Mobile Agents in Hostile Environments, proceeding of ACISP 2000, pp289-297, 2000; Yang Shi, Xiaoping Wang, Liming Cao, et.al.A Security Scheme of Electronic Commerce for Mobile AgentsUses Undetachable Digital Signatures. The Third International Conference on Information Security, ACM Press, 2004: pp.242-243. and Yang Shi, Xiaoping Wang, Liming Cao, Jianxin Ren. Secure Mobile Agents in Electronic Commerce by Using Undetachable Signatures from Pairings.Proc.The 4th International Conference on Electronic Business,pp.1038-1043.Any kind of inseparable electronic signature given in the three documents can control the leakage of the signature key or signature method to a certain extent.

In order to solve the security threat that the key generator will be attacked to obtain the signature key in the absence of a reliable key distribution agency H. Krawezyk. Simple forward-secure signatures from any Signaturese heme. Proceedings of the 7th ACM Conference on Computer and Communications Seeurity, 2000, pp.108-115. The literature proposes a forward secure signature method to solve this kind of problem, and even when the host of the signer is compromised to form a white box attack environment, the signature key can still be guaranteed to be forward secure, That is to say, the key of this scheme changes with time, and the signature key that has been used before the time point of being compromised cannot be obtained, so it is called forward security.

However, each of these signature schemes cannot meet the current security requirements of mobile agents.

Contents of the invention

As we all know, the signature key is the core of a signature scheme. If the signature key is stolen, the entire signature method will be useless. Therefore, the forward security signature method mentioned above can allow the signature key to be updated over time. , the key is irreversibly updated every time period, so that even when the signer is compromised, the security of the signature key before the current time period can still be guaranteed, that is, the signed data cannot be counterfeited.

However, the current forward-secure signature scheme cannot achieve the effect of indivisible signatures. The signature scheme with two characteristics at the same time has become a blank in the field of mobile agent security, because among the public signature schemes, there is no effective scheme that combines the two characteristics, because this combination can be said to be quite difficult. The purpose of the present invention is to overcome the respective deficiencies of the current two solutions in the field of mobile agent security, and to solve the problem of generating an electronic signature that requires itself to carry a signature algorithm and a signature key, which will allow an attacker to forge a signature algorithm from the agent , even cracking the security issue of the signature key, and can remove the threat that the mobile agent may face when it passes a malicious host and may form a white-box attack (WBAC) environment, and does not require a special security agency to issue certificates or The key increases the scope of application of the signature method. Furthermore, it not only reduces the communication risk, but also offsets the huge threat of the authoritative organization being breached, filling the gap in the field of mobile security.

The innovation of the present invention lies in the design of a special algorithm so as to simultaneously achieve the security features of forward security and inseparable signatures. It is not a simple assembly of algorithms, but an organic combination of two security solutions achieved through theoretical reasoning and corresponding experiments.

For this reason, the technical scheme that the present invention provides is:

A kind of forward safe inseparable digital signature method, it is characterized in that, it comprises eight steps as follows: Step 1. certain client completes shopping on a client computer, then, computer generates mobile agent, client computer afterwards Run Algorithm 1. according to the specified security level (input the required security index k), the algorithm is defined as follows

Algorithm 1. Key generation algorithm: KGen(1 ^k ) inputs the total number of time segments T and 1 ^k as a security parameter when k∈□ (□ is a natural number), and the algorithm outputs the public key setting and the initial key S ₀ .

Ω Explanation: In the above, the security parameter 1 ^k is a conceptual statement, and k is the security index, which can be simply understood as the encryption system is of k-bit length. When it is implemented, it depends on the project requirements and the public key encryption system used. (such as hyperelliptic elliptic curves, etc.) depends.

G ₁ in Ω is a multiplicative cyclic group with order q, and G ₂ is also a multiplicative cyclic group with order q. G and P are fixed generators of _G1 and _G2 respectively. Is a linear mapping, the elements in G ₁ and G ₂ are firstly Cartesian product, and then mapped to the elements in G _T. and H ₂ : {0,1} ^* →G ₁ are two special hash maps, which are used to map any binary value to and G ₁ , is the additive group of integers of order q with no zero elements.

Note: Suppose there is a homomorphic map ψ:G ₂ →G ₁ with ψ(P)=G.

Definition: Decision Diffie-Hellman problem (co-DDH) on (G ₁ ,G ₂ ): Given P, P ^a ∈ G ₂ and Y, Y ^b ∈ G ₁ as input, if a=b then output yes , otherwise output no. When the output is yes, we say (P,P ^a ,Y,Y ^b ) is a Diffie-Hellman tuple (co-DHT).

Hypothesis: We assume can be calculated quickly, so co-DDH is easy to solve on (G ₁ ,G ₂ ). This method is based on this assumption.

The initial key S ₀ is generated:

from S ₀ is taken out immediately, and U ₀ is calculated

For(j=1; j≤T; j++) do

EndFor

After the cycle is completed, erase s _j ,j=1,…,T, store CERT _j ,j=1,…,T

Note: Here, this algorithm assumes that U ₀ is a data aggregate, therefore, the global setting Ω is stored in U ₀ , that is, the public key element carries global information.

The KGen(1 ^k ) algorithm is completed, output the public key U ₀ and the initial key S ₀ , and proceed to the next step.

Step 2: Then the client inputs public key U ₀ , initial key s ₀ , CERT _j and current time slice j to Algorithm 2, and then runs Algorithm 2, which is defined as follows:

Algorithm 2.

KUpd(s _j-1 ,CERT _j ,j,U ₀ )

BEGIN

<U ₀ ′,j′,U _j ′,Λ _j >←CERT _j

return ⊥ //abort

erase s _j-1

return s _j

END

After erasing S ₀ , the algorithm returns to S ₁ and proceeds to the next step

Step 3. The client completes the transaction and is ready to send the mobile agent for the transaction.

If the current key has expired, go to step 4, otherwise go to step 5.

Step 4. The client takes the key S _j-1 of the previous period, the current period j, the public key U ₀ and the CERT _j generated by Algorithm 1 as input, re-runs KUpd to obtain the key S _j of the next period, and proceeds to the next step .

Step 5. The client takes REQ_C||ID _C , s _j , and CERT _j as input, where REQ_C||ID _C is customer demand and user ID belongs to sensitive data and runs Algorithm 3, which is defined as follows:

Algorithm 3.

UndSigFunGen(REQ_C||ID _C ,s _j ,CERT _j )

Begin

H←H ₂ (REQ_C||ID _C );

end

output make the agent carry;

Then the client runs Algorithm 6 to sign the proxy sensitive data. The input is sensitive data, the current time segment j and the current key s _j . The algorithm is defined as follows

Algorithm 6.

Sign(s _j ,j,Msg)

Begin

return σ _j

end

The output is the signature of period j, which is also carried by the agent. proceed to the next step

Step 6. When the store receives the proxy, it first uses Algorithm 7 to check the legitimacy of the proxy, that is, to check σ _j . The input is the public key, signature message, signature and the current period. The algorithm is defined as follows:

Algorithm 7.

Vrfy(U ₀ ,σ,j,Msg)

Begin

<CERT _j ,σ′>←σ;<U ₀ ′,j′,U _j ′,Λ _j >←CERT _j

If(U ₀ ≠ U ₀ ′) return 0

If(j≠j′) return 0

Else return 1

end

If the output is 0, exit the transaction

If the output is 1, judge whether the agent continues to migrate between stores. If necessary, repeat this step, that is, go to step 6; otherwise, go to step 7.

Step 7. At this point, the store has made a final decision, if the transaction is completed, then generate CONTRACT and other transaction information as input, run Algorithm 4, defined as follows:

Algorithm 4.

UndSig(Msg)

Begin

h=H ₁ (Msg)

end

The output is the final inseparable signature, denoted as Z here. Save into the agent, then make the agent migrate back to the client for the next step.

Step 8. The client receives the transaction completion agent, takes U ₀ , Z, j, Msg, REQ_C||ID _C as input, where Msg is CONTRACT and other transaction information, and runs Algorithm 5 to check the validity of Msg, algorithm definition as follows:

Algorithm 5.

UndVrfy(U ₀ ,Z,j,Msg,REQ_C||ID _C )

Begin

<<CERT _j ,Z′>,j>←Z;<U ₀ ′,j′,U _j ′,Λ _j >←CERT _j

If(U ₀ ≠ U ₀ ′) return 0

If(j≠j′) return 0

If(Msg does not satisfy REQ_C) return 0

else return 1

end

If the algorithm output is 0, terminate the transaction;

Otherwise the output is 1 and the transaction is completed.

If the user still needs to trade, skip directly to step 3

At this point, the entire forward-secure indivisible method has been completed.

Through the above technical solutions, the present invention can realize forward-safe inseparable digital signatures in a white-box attack environment (for example, on an unsafe computer). This solution solves the problem of lack of a good security solution on the current mobile agent. Throughout the scheme, mobile agents do not need to carry the private key as the digital signature they generate represents the original signature, so the private key will not be affected. The function of encryption is combined with the request of the original signer, so the misoperation of the signature algorithm can be prevented. In addition, since the scheme is forward secure, the scheme does not require a special key distribution organization, and even if the signer is compromised, the scheme still has forward security (the signature key before the compromised current time slice is not will leak). Therefore, the scheme can well resist the threats faced by mobile agents at present.

Description of drawings

Fig. 1 is the working principle of the forward secure non-detachable digital signature method of the present invention.

Figure 2 is a schematic flow chart of the entire method.

Figure 3 shows the basic relationship of the seven basic algorithms.

detailed description

The present invention discloses a forward secure inseparable digital signature method, as shown in Figure 3, the method includes the following seven algorithms:

1) KGen: The key generation algorithm KGen takes the security parameter 1 ^k (k∈□) and the total period T of the scheme to operate, or other relevant parameters as input, and returns a basic public key PK and the corresponding Initial key (signature key) SK ₀ . Algorithmic complexity is indeterminate.

2) KUpd: The key upgrade algorithm KUpd takes the key SK _j-1 of the previous key period as input and returns the current signature key SK _j . Algorithm time complexity is usually deterministic.

3) UndSigFunGen: The inseparable signature method generation algorithm UndSigFunGen is a deterministic, polynomial time complexity algorithm, which takes the user's requirement REQ_C, the user's identity ID _C and the user's public key and the current period's key as input, the algorithm return method pair f( ) and

4) UndSig: Inseparable signature algorithm FSUndSig is a polynomial time complexity algorithm that takes relevant contract restrictions (or corresponding hash values) as input and returns an inseparable digital signature z=ζ _j =<ζ,j> .

5) UndVrfy: Inseparable signature verification algorithm FSUndVrfy is a polynomial time complexity algorithm, which takes the relevant contract constraints and the indivisible signature z as input. The algorithm returns "accepted" or "rejected", simply 1 or 0.

6) Sign: The signature algorithm Sign takes current epoch key SK _j and message M as input, and returns the signature of epoch j and message M. This article is recorded as Algorithmic complexity may be indeterminate. A signature is usually a pair of values, an epoch j and a corresponding label σ.

7) Vrfy: The verification algorithm Vrfy uses the public key PK, the message M and the signature <j, σ> to return "accept" or "reject", in simple terms 1 or 0. Here it is denoted as b←Vrfy _PK (M,<j,σ>).

Figures 1 and 2 describe the use of this algorithm in a forward-secure indivisible digital signature scheme.

As shown in Figure 1, identity-based non-detachable digital signature schemes generally work as follows. First, the client runs KGen(1 ^k ) to generate the corresponding global parameters, public key and initial key. Then run KUpd to update the initial key, and then update the key continuously according to the passage of time. Then the client completes the shopping, generates a proxy, and first uses UndSigFunGen to generate an inseparable signature function Then use Sign to sign the proxy's sensitive data. Afterwards, the agent is migrated to the store server. After receiving the agent, the store first uses Vrfy to verify the legality of the agent. If it is not legal, the transaction will be terminated directly. If it is reasonable, the transaction will continue to be processed, and then the transaction will be migrated between stores to complete the transaction, and finally the contract will be generated in the final store. And other transaction information, and then use UndSig to generate an inseparable signature for these information, and then send the agent back to the client. The client receives the proxy and uses UndVrfy to verify the legitimacy of the transaction. Only when the algorithm output is 1 can the transaction be successful. If other transactions are continued later, the new key may be used for signature, even if the current key is stolen, the previous transaction can be guaranteed to be safe.

As shown in Figure 2, the forward-secure indivisible signature scheme includes the following eight steps:

1) The client runs KGen to generate global settings, public key U ₀ and initial key s ₀

2) The client runs KUpd to output the first time period key s ₁

3) Complete the purchase list and make a transaction. If the key has not expired, directly execute 5)

4) The client runs KUpd to output the next time period key s _j

5) The client runs UndSigFunGen output make the agent carry

The client runs Sign to sign the agent's sensitive data;

6) The store server uses Vrfy to verify the proxy, and the transaction is terminated directly if it is illegal

7) Make a transaction and sign the contract with UndSig

8) The client uses UndVrfy to verify the contract, if it is not legal to terminate the transaction.

Figure 3 shows the relationship between the seven algorithms: first, KGen generates global variables, public keys, and initial keys, then KUpd is responsible for updating the keys as time goes by, and UndSigFunGen is responsible for generating a "semi-finished product" to make the transfer There is no need to expose the signature key during the process. UndSig is to generate a "finished product" from the previous "semi-finished product", that is, an inseparable signature. UndVrfy is the corresponding verification method, and the remaining Sign and Vrfy are the corresponding common signature methods.

The present invention will be further described below with specific embodiment:

This scheme is based on bilinear pairing. Its security depends on the difficulty of solving computational Diffie-Hellman problems in Diffie-Hellman groups.

This example is written in JAVA language and implemented using The Java Pairing Based Cryptography Library (JPBC) library. The JPBC library is a set of standard APIs for asymmetric cryptosystems. The official website is http://gas.dia.unisa.it/projects/jpbc/.

The implementation of the algorithm KGen(1 ^k ) is based on the Type A elliptic curve of JPBC, where the official configuration file a.properties is used as input, so this strength does not require obvious 1 ^k parameters. The properties of the established elliptic curve are as follows:

The elliptic curve adopts y ² =x ³ +x constructed on the field F _q , where the prime number q=3mod4, and the JPBC library provides an API for mapping e:G ₁ 1×G ₂ →G _T , in the currently set elliptic curve system Above, G ₁ =G ₂ in the mapping, so the existence of a homomorphic mapping ψ:G ₂ →G ₁ in the definition of KGen(1 ^k ) has the condition of ψ(P)=G. Here, in use, after the initialization of the elliptic curve system is completed, a Pairing object will be obtained. Through the member functions of Pairing, getG1(), getGT() and getZr() can get G ₁ , G ₂ and Then get the generator P of G ₁ through getG1().newRandomElement(), similarly from Taking S, the member function powZn(s) of P can be called to calculate P _pub , and by calling G ₁ or The member function newElementFromHash() under can realize the two hash functions in Ω. According to the description of the algorithm, Ω can be easily constructed.

Similarly, looking at the 7 algorithms, the calls are basically the above functions, and there is no more difference, so I will not introduce them here. After the 7 algorithms are implemented in JAVA, you can follow the steps below:

Step 1. A customer completes shopping on a client computer. Immediately, the computer generates a mobile agent, and then the client computer runs Algorithm 1 according to the specified security level (input required security index k), and the algorithm outputs a public key set up U ₀ and the initial key S ₀ . Store the global setting Ω in U ₀ , that is, the public key element carries global information.

The KGen(1 ^k ) algorithm is completed, output the public key U ₀ and the initial key S ₀ , and proceed to the next step.

Step 2 Then the client inputs public key U ₀ , initial key S ₀ , CERT _j and current time slice j to Algorithm 2, then runs Algorithm 2, the algorithm returns S ₁ , and proceeds to the next step

Step 3. The client completes the transaction and is ready to send the mobile agent for the transaction.

If the current key has expired, go to step 4, otherwise go to step 5.

Step 4. The client takes the key S _j-1 of the previous period, the current period j, the public key U ₀ and the CERT _j generated by Algorithm 1 as input, re-runs KUpd to obtain the key S _j of the next period, and proceeds to the next step .

Step 5. The client takes REQ_C||ID _C , s _j , and CERT _j as input, where REQ_C||ID _C is customer demand and user ID belongs to sensitive data and runs Algorithm 3, output Stored in the proxy port; then the client runs Algorithm 6 to sign the sensitive data of the proxy, the input is the sensitive data, the current time segment j and the current key S _j , and the output is the signature of period j, which is also stored in the proxy. proceed to the next step

Step 6. When the store receives the proxy, it first checks the legitimacy of the proxy with Algorithm 7. The input is the public key, signature message, signature and the current period. If the output is 0, exit the transaction; if the output is 1, determine whether the proxy continues to be in the store If necessary, repeat this step, that is, go to step 6; otherwise, go to step 7.

Step 7. Here, the store has made a final decision. If the transaction is completed, then generate CONTRACT and other transaction information as input, run Algorithm 4, and the output is the final inseparable signature, which is denoted as Z here. Save into the agent, then make the agent migrate back to the client for the next step.

Step 8. The client receives the transaction completion agent, takes U ₀ , Z, j, Msg, REQ_C||ID _C as input, where Msg is CONTRACT and other transaction information, and runs Algorithm 5 to check the legitimacy of Msg, if the algorithm If the output is 0, the transaction is terminated; otherwise, the output is 1, and the transaction is completed.

If the user still needs to trade, skip directly to step 3

At this point, the entire forward-secure indivisible method has been completed.

Claims (1)

1. A forward-safe inseparable digital signature method is characterized in that it comprises eight steps as follows: Step 1. A customer completes shopping on a client computer. Immediately, the computer generates a mobile agent, and then the client computer runs Algorithm 1 according to the specified security level (input the required security index k). The algorithm is defined as follows Algorithm 1. Key generation algorithm KGen(1 ^k ): Input the total number of time segments T and 1 ^k when ( is a natural number), the algorithm outputs a public key set and the initial key s ₀ ; G ₁ in Ω is a multiplicative cyclic group with order q, and G ₂ is also a multiplicative cyclic group with order q; G and P are fixed generators of G ₁ and G ₂ respectively; is a linear mapping, the elements in G ₁ and G ₂ are first Cartesian product, and then mapped to the elements in G _T ; and H ₂ : {0,1} ^* →G ₁ are two special hash maps, which are used to map any binary value to and G ₁ , is the additive group of integers of order prime q and without zero elements; Definition: Decision Diffie-Hellman problem (co-DDH) on (G ₁ ,G ₂ ): Given P, P ^a ∈ G ₂ and Y, Y ^b ∈ G ₁ as input, if a=b then output yes , otherwise output no; when the output is yes, it is said that (P,P ^a ,Y,Y ^b ) is a Diffie-Hellman tuple (co-DHT); Store the public key setting Ω in U ₀ , that is, the public key element carries global information; The KGen(1 ^k ) algorithm is completed, output the public key U ₀ and the initial key s ₀ , and proceed to the next step; Step 2: Then the client inputs public key U ₀ , initial key s ₀ , CERT _j and current time slice j to Algorithm 2, and then runs Algorithm 2, which is defined as follows: Algorithm 2. KUpd(s _j-1 ,CERT _j ,j,U ₀ ) BEGIN<U ₀ ',j',U _j ',Λ _j >←CERT _j ${\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&LeftArrow;</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ;</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&LeftArrow;</span>{\mathrm{<span\; class="notranslate">\; P</span>}}^{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}$ $\mathrm{<span\; class="notranslate">\; I</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&NotEqual;</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>$ return⊥//abort erase s _j-1 return s _j END After erasing s ₀ , the algorithm returns to s ₁ and proceeds to the next step; Step 3. The client completes the transaction and prepares to send the mobile agent to conduct the transaction; If the current key expires, go to step 4, otherwise go to step 5; Step 4. The client takes the key s _j-1 of the previous period, the current period j, the public key U ₀ and the CERT _j generated by Algorithm 1 as input, re-runs KUpd to obtain the key s _j of the next period, and proceeds to the next step ; Step 5. The client takes REQ_C||ID _C , s _j , and CERT _j as input, where REQ_C||ID _C is customer demand and user ID belongs to sensitive data and runs Algorithm 3, which is defined as follows: Algorithm 3. UndSigFunGen(REQ_C||ID _C ,s _j ,CERT _j ) Begin H←H ₂ (REQ_C||ID _C ); $\mathrm{<span\; class="notranslate">\; K</span>}<span\; class="notranslate">\; \&LeftArrow;</span>{\mathrm{<span\; class="notranslate">\; h</span>}}^{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}$ $\begin{array}{cc}\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; p</span>}& {\mathrm{<span\; class="notranslate">\; f</span>}}_{{\mathrm{<span\; class="notranslate">\; signed</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; <</span><span\; class="notranslate">\; <</span>{\mathrm{<span\; class="notranslate">\; CERTs</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; K</span>}}^{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; ></span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ></span>\end{array}$ $\begin{array}{cc}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& {\mathrm{<span\; class="notranslate">\; f</span>}}_{{\mathrm{<span\; class="notranslate">\; signed</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; (</span><span\; class="notranslate">\; \&CenterDot;</span><span\; class="notranslate">\; )</span>\end{array}$ end output make the agent carry; Then the client runs Algorithm 6 to sign the proxy sensitive data. The input is sensitive data, the current time segment j and the current key s _j . The algorithm is defined as follows Algorithm 6. Sign(s _j ,j,Msg) Begin ${\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; \&LeftArrow;</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; ;</span>\mathrm{<span\; class="notranslate">\; \&sigma;</span>}<span\; class="notranslate">\; \&LeftArrow;</span><span\; class="notranslate">\; <</span>{\mathrm{<span\; class="notranslate">\; CERTs</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ></span><span\; class="notranslate">\; ;</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&LeftArrow;</span><span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; \&sigma;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ></span>$ return σ _j end The output is the signature of period j, which is also carried by the agent; proceed to the next step Step 6. When the store receives the proxy, it first uses Algorithm 7 to check the legitimacy of the proxy, that is, to check σ _j . The input is the public key, signature message, signature and the current period. The algorithm is defined as follows: Algorithm 7. Vrfy(U ₀ ,σ,j,Msg) Begin <CERT _j ,σ'>←σ;<U ₀ ',j',U _j ',Λ _j >←CERT _j If(U ₀ ≠ U ₀ ') return 0 If(j≠j') return 0 $\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; I</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&NotEqual;</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ,</span>{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>& \mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\end{array}$ $\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; I</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&NotEqual;</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>& \mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\end{array}$ Else return 1 end If the output is 0, exit the transaction If the output is 1, judge whether the agent continues to migrate between stores. If necessary, repeat this step, that is, go to step 6; otherwise, go to step 7; Step 7. At this point, the store has made a final decision, if the transaction is completed, then generate CONTRACT and other transaction information as input, run Algorithm 4, defined as follows: Algorithm 4. UndSig(Msg) Begin h=H ₁ (Msg) $\begin{array}{cc}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& {\mathrm{<span\; class="notranslate">\; f</span>}}_{{\mathrm{<span\; class="notranslate">\; signed</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; )</span>\end{array}$ end The output is the final inseparable signature, denoted as Z here, saved to the proxy, and then the proxy is migrated back to the client for the next step; Step 8. The client receives the transaction completion agent, takes U ₀ , Z, j, Msg, REQ_C||ID _C as input, where Msg is CONTRACT and other transaction information, and runs Algorithm 5 to check the validity of Msg, algorithm definition as follows: Algorithm 5. UndVrfy(U ₀ ,Z,j,Msg,REQ_C||ID _C ) Begin <<CERT _j ,Z'>,j>←Z;<U ₀ ',j',U _j ',Λ _j >←CERT _j If(U ₀ ≠ U ₀ ')return 0 If(j≠j') return 0 If(Msg does not satisfy REQ_C) return 0 $\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; I</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&NotEqual;</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; j</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ,</span>{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>& \mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\end{array}$ $\begin{array}{ccc}\mathrm{<span\; class="notranslate">\; I</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&NotEqual;</span>\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; R</span>}\mathrm{<span\; class="notranslate">\; E.</span>}\mathrm{<span\; class="notranslate">\; Q</span>}<span\; class="notranslate">\; \_</span>\mathrm{<span\; class="notranslate">\; C</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; ID</span>}}_{\mathrm{<span\; class="notranslate">\; C</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>& \mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; t</span>}\mathrm{<span\; class="notranslate">\; u</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; no</span>}& \mathrm{<span\; class="notranslate">\; 0</span>}\end{array}$ else return 1 end If the algorithm output is 0, terminate the transaction; Otherwise, the output is 1 and the transaction is completed; If the user still needs to trade, skip directly to step 3.