CN104539425B

CN104539425B - Multi-receiver label decryption method based on multivariable, many security attributes

Info

Publication number: CN104539425B
Application number: CN201410821537.4A
Authority: CN
Inventors: 李慧贤; 韩冬棋; 范天琪; 张晓莉
Original assignee: Northwestern Polytechnical University
Current assignee: Dongguan Sanhang anxirui Information Technology Co.,Ltd.
Priority date: 2014-12-25
Filing date: 2014-12-25
Publication date: 2017-11-03
Anticipated expiration: 2034-12-25
Also published as: CN104539425A

Abstract

The invention discloses a kind of multi-receiver label decryption method based on multivariable, many security attributes, the technical problem for solving existing multi-receiver label decryption method solution label Migong levelling difference.Technical scheme is the algorithm KeyGen of the key pair comprising generation systematic parameter and each user, signs the close algorithm Designcrypt of close algorithm Signcrypt reconciliation label.Sign in the finite field F that close algorithm feature based is q, system and have N+ τ participants, selection one leader L, leader L calculate interference data from actual label close person, and interference data mix with True Data, allow recipient can not judge the identity of the close person of actual label.The present invention ensure that sender anonymity using threshold technique；The list of identities of recipient is no longer directly given in communication data, it is ensured that recipient's anonymity and in advance judgement property；The information fusion of the close key message of label and authorized receiver will be solved into a parameter list, it is ensured that understand label Migong levelling.

Description

Multi-receiver label decryption method based on multivariable, many security attributes

Technical field

It is more particularly to a kind of based on multivariable, many security attributes the present invention relates to a kind of multi-receiver label decryption method Multi-receiver label decryption method.

Background technology

Stopover sites will ensure the encryption technology of message confidentiality and ensure that the signature technology of message integrity is fused to one In individual logic step, while two functions of encryption and signature are realized, than simply first signature is re-encrypted with higher efficiency. With the development of science and technology, attack technology is also constantly upgraded, the attack such as message is subject to distort in the transmission, forged.Protect message Integrality and the demand of confidentiality increasingly strengthen.Label secret skill art is quickly grown after being suggested, and is occurred in that and is adapted to varying environment Stopover sites.Because present a large amount of network english teachings are all simultaneously in face of numerous users, such as pay TV, DVD copyrights connect more The stopover sites of receipts person arise at the historic moment.

" the Efficient and provably secure multi-receiver identity based of document 1 Signcryption, ACISP 2006, Springer-Verlag, LNCS 4058, pp.195-206 " are proposed based on body first The multi-receiver stopover sites of part, realize signature and encryption and are completed simultaneously in a logic step.Authorize and receive in scheme Person verifies the validity of message using the private key of oneself, but the program does not have recipient's identity information, and recipient can not judge certainly Whether oneself is legitimate receiver.

" the Efficient identity-based signcryption scheme for multiple of document 2 receivers.Proc.the Autonomic and Trusted Computing 4th International Conference,13–21.doi:10.1007/978-3-540-73547-2_4 " recipient's identity is added in stopover sites List, but the program is easily by the forgery attack to sender, it is impossible to ensure security.

" the A novel ID-based anonymous signcryption scheme.Proc.the of document 3 Advances in Data and Web Management Joint International Conferences,604– 610.doi:10.1007/978-3-642-00672-2_58. " proposes the anonymous stopover sites of recipient, but the program is present Many potential safety hazards, especially it cannot be guaranteed that the close fairness of the solution label of recipient.The development of quantum techniques in recent years is to tradition Label secret skill art brings huge threat, in order to resist quantum attack, " Quantum Attack-resistant Certificateless Multi-receiver Signcryption Scheme.PLOS ONE.8(6): E49141.2013. anti-quantum calculation technology " is added in stopover sites, but it can not realize the close fairness of solution label.

The content of the invention

In order to overcome the shortcomings of that existing multi-receiver label decryption method solution label Migong levelling is poor, the present invention provides a kind of based on many The multi-receiver label decryption method of variable, many security attributes.Key pair of this method comprising generation systematic parameter and each user Algorithm KeyGen, the close algorithm Signcrypt of label conciliate the close algorithm Designcrypt of label.It is the limited of q to sign close algorithm feature based N+ τ participants, including N number of close person of label and the τ close person (N >=t) of solution label are had in domain F, system, it is close that label are conciliate in the close person's set of label Person's set is not occured simultaneously.This method one leader L of selection from actual label close person, the actual close person of label is with the key of oneself to message Carry out label close.In order to hide the identity of the close person of actual label, leader L can calculate interference data, and these data are that L is not knowing non- Calculate what is obtained in the case of the key of the actual close person of label for each non-actual close person of label.Data and reality is disturbed to sign the true of close person Real data is mixed, and allows recipient can not judge the identity of the close person of actual label.The present invention ensure that hair using threshold technique The person's of sending anonymity；The list of identities of recipient is no longer directly given in communication data, it is ensured that recipient's anonymity and in advance Judgement property；The information fusion of the close key message of label and authorized receiver will be solved into a parameter list, it is ensured that understand label close Fairness.

The technical solution adopted for the present invention to solve the technical problems is：It is a kind of based on multivariable, many security attributes it is many Recipient signs decryption method, is characterized in using following steps：

Step 1: producing user i public key pk by KeyGen algorithms_iWith user i private key sk_i, wherein i=1 ..., N. System selects a leader L in the colony of the actual close person's composition of t label, is t blocks by whole clear-text message M points.Selection One Com function and five Hash functions, Com：Fⁿ||F^m→F^o, n>M, | | it is cascade symbol, Com functions meet statistics and hidden With bind calculation attribute, o=128 is selected.H₀：{0,1}*→{0,1}^l, H₁：{0,1}^*→{0,1,2,3}^k, H₂：{0,1}^l+m→ Z_q*, H₃：Z_q*→Z_q*, H₄：Z_q*→{0,1}^n+M/t.Systematic parameter is obtained for params=(H₀,H₁,H₂,H₃,H₄,q,Com).Letter Several detailed processes is as follows,

The hiding statistical attribute of Com functions represents the output knot that different input parameters is obtained after the calculating of Com functions Fruit is different, and result is for recipient's undistinguishable.The bind calculation attribute of Com functions represents that input data passes through Com functions Calculating is obtained after output result, and sender can not deny the value of input data.

Sender determines the length of the input parameter of Com functions.The length of the input parameter of Com functions is n+m, Com letters Several input parameters includes two parameters, and first parameter is the n-dimensional vector based on finite field F, and second parameter is based on F M dimensional vectors.Definition input parameter is Χ.The security parameter that ω is Com functions is defined, φ=(n+m)+4 of 2 ω+2 is defined.Selection One is collided the Hash functions h avoided₅：{0,1}^φ→{0,1}^ω, it is known that one is collided the function group H avoided₆：{0,1}^φ→{0, 1,}^n+m.Com output includes two parts, is designated as c and d.C and d are sent to recipient by sender.h₅It is disclosed Hash letters Number.

A) sender random selection r ∈ { 0,1 }^φ, calculate y=h₅(r).

B) sender is from H₆Hash function groups in select a h₆∈H₆, meet h₆(r)=X.

C) Com is output as c=(h₆, y), d=r.

Recipient verifies y=h₅And h (r)₆(r)=X, due to h₆And h₅All it is the function that collision is avoided, therefore in the absence of one Meet h₆(r ')=X and y=h₅The r ' of (r ').Sender can not deny X.

User i selects a transformation equation group F_i, the reversible affine transformation Γ of simultaneous selection two_i∈FⁿAnd △_i∈F^m.It is required that User i selection random vectors s_i∈Fⁿ, user i private key isMeetAndIn be free of constant term, Specific method is as follows.

EnsureAnd do not include constant term, this algorithm acquiescence in equationMonomial coefficient be 1；

A) vectorial s of the system in user i_i=(s_1i,s_2i,…,s_ni) in find the component that first is not 0 from right turn left, The subscript value of the component is assigned to variable x.System is that user i randomly chooses a multinomial with n variable and m equation Equation groupEquation group does not have constant term.CalculateNowValue not necessarily For 0, it is necessary to change equation group according to process b)The coefficient of middle equation, untilEach component value be equal to Untill 0.

B) Equation f is selected from equation group successively_j, j=1 ..., m.SelectionJ-th of component IfValue not be 0, according to below equation to f_jMake an amendment, untilValue be 0 untill.In below equationRepresent equation f_jIn x-th of monotropic quantifier coefficient, s_xIt is s_i=(s_1i,s_2i,…,s_ni) in subscript value be x component：

Value be changed into after 0, select next equation, the coefficient of equation, Zhi Daofang changed using the method for formula (4) All equations of Cheng Zuzhong are all met after requirement, stop aforesaid operations.

As long as s_i=0 can just meetIt is the non-actual close person's simulated operation of label to facilitate leader L.User i public affairs Key includes two parts, and Part I isWherein.It is the composite symbol of mapping, Part II is z_i=P_i (s_i).User i public key is (P_i,z_i)。

Step 2: signing close process using Signcrypt, six steps are divided into.

step1:Calculate the commitment value of the close person of label.

The actual close person i of label selects k parameter tuple (r_i,t_j,e_m), wherein i=0,1, j=0,1, m=0,1, each parameter The value of tuple is different from, and meets s_i=r₀ ^(j)+r₁ ^(j), r₀ ^(j)=t₁ ^(j)+t₀ ^(j),It is as follows.

Each actual close person of label calculates commitment value using k group parameters tuple, and obtaining commitment value using i-th group of parameter tuple isWithComputational methods are as follows：

Sign close person i selections γ_i={ 0,1 }ⁿ, then to message blocks M_iCalculated, obtainedFinally sign Close person i will It is sent to L.

step2:Leader L calculates main promise and challenging value.

Leader L receives the commitment value of the close person of other t-1 label.Leader L calculates the commitment value of oneself and basis's Principle is the N-t non-close person's simulation commitment values of label.Leader L calculates main promise after collecting the promise for each signing close user.By In all close same challenging values of users to share of label, so leader L must be directed to each challenging value component, all label are close The commitment value of user relevant position is arranged to together.Likewise, responseIt is also to be organized according to the component of challenging value to one Rise.Φ_j、Ψ_jAnd Λ_jBe by the jth group commitment value taxonomic revisions of the close users of all label together.I.e. all close users' of label InIt is organized and obtains Φ together₁,It is organized and obtains Φ together₂, the like, until all close users' of labelIt is organized and obtains Λ together_k.γ is The message blocks of all close users of labelArrangement result.θ_i,jIt is the θ for signing close user i_iJ-th of component, that is, sign close User i's It is the close user i of labelJ-th of component, that is, sign close user i'sπ_i,jIt is the π for signing close user i_i J-th of component, that is, sign close user i'sWherein j=1 ..., k, i=1 ..., N.

Φ_j=H₀(θ_1,j||...||θ_N,j)

Λ_j=H₀(π_1,j||...||π_N,j)

The main promise of all senders

Leader L uses H₁To the promise receivedHash calculating is carried out with γ, challenge vector is obtainedI.e. For the vector in k gts.

Leader L willIt is sent to remaining the t-1 close person of label.

step3:Sign close person and calculate response.

The response for signing close person i is ζ_i。ζ_iJth position component ζ_i,j, 1≤j≤k is according to challenging valueJth position componentCalculate what is obtained.According toValue,Jth position componentFor 0,1 and 2, then sign close user i and need to use the jth group of oneself Parameter member set constructor response componentCalculating process is as follows：

Ifζ_i,j=(r₀ ^(j),t₁ ^(j),e₁ ^(j))

Ifζ_i,j=(r₁ ^(j),t₁ ^(j),e₁ ^(j))

Ifζ_i,j=(r₁ ^(j),t₀ ^(j),e₀ ^(j))

WhenFor 3 when represent to skip calculating group response.Close person i is finally signed ζ_i=(ζ_i,1,ζ_i,2,…,ζ_i,k) hair Give leader L, herein ζ_iThere is k component, this is situation when element 3 being not present in challenging value, because working asDuring equal to 3, need Skip this group of response component of calculating.IfIt is middle to there is the component that x value is 3, ζ_iComponent number then be k-x.In the present invention Middle acquiescence ζ_iThere is k component.

step4:L calculates main response value and specifies recipient.

Leader L calculates the response of oneself, and collects the response that other t-1 signer is sent.Simulate N-t non-realities Sign the response of close user in border.Leader L calculates main responseIt isJ-th of component, according to j-th of component of challenging valueCalculate what is obtained.

If

IfCorresponding response is not calculated.

Assuming that there is τ recipient.For recipient i, L random selections Q_i∈F^m, 1≤i≤τ, and be calculated as below：

R_i=H₃(S_i)

Here S_iAnd R_iIt is to be calculated for each authorized receiver, recipient can only be according to S_iAnd R_iOneself could be judged Whether it is authorized to.Lead L to arrange the identity information of sender and recipients to together, be designated as U.

step5:The actual close person of label calculates ciphertext and the identity information of recipient.

Actual label close person i, i=1 ..., t, select a secret parameter u_i∈Z_q*, the secret parameter is used for encrypting message, Only authorized receiver could obtain this secret parameter.The actual close person i of label uses u_iMessage is encrypted, ciphering process is as follows：

W_i=H₄(u_i)⊕(γ_i||M_i)

In order to reach that only authorized receiver could obtain secret parameter, the actual close person i of label authorizes solution label are close to use by all The information at family and the secret parameter are stashed by following mode.

The actual close person i of label obtains parameter list η_i=(ι₁ ⁽ⁱ⁾,…,ι_τ ⁽ⁱ⁾).It is actual to sign close person i by (W_i,η_i) it is sent to neck Lead L.

step6:Leader L arranges the label confidential information of all close users of label and is sent to verifier.

Lead L that together, the close message coalescing of all label being collected into is finally obtained into message ciphertext C.Have：

W=(W₁,…,W_t)

R=(R₁,…,R_τ)

C=(R, U, η₁,…,η_t,W)

Step 3: using the close process of Designcypt algorithm solution label, being divided into two steps.

step1:Verify the legitimacy of recipient.

Recipient V is received after ciphertext C, according to challenging value componentJ=1 ..., k, obtain N group commitment values WithI=1 ..., N.Three classes of calculating process point：

When the jth position component of challenging valueBe worth for 0 when, V can only be from main responseJth position componentIn obtain N groups ginseng Number r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾, main responseInclude k component, each componentInclude the response of N number of sender.Recipient V Use i-th group of data r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWith

V-arrangement is into the responses of the close users of all label, Ψ '_jIt is basisTo allResult of calculation.Λ′_jIt is basis To allResult of calculation.

WhenBe worth for 1 when, V can only be fromIn obtain N group parameters r₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾.V uses the data for signing close user i r₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWith

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allResult of calculation.Λ′_jIt is basis To allResult of calculation.

WhenBe worth for 2 when, V can only be fromIn obtain N group parameters r₁ ⁽ⁱ⁾, t₀ ⁽ⁱ⁾, e₀ ⁽ⁱ⁾, the close user i of V use label data r₁ ⁽ⁱ⁾, t₀ ⁽ⁱ⁾, e₀ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWithIt is calculated as follows：

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allResult of calculation.Ψ′_jIt is basis To allResult of calculation.

WhenBe worth for 3 when, recipient stop checkingJudge next bitValue, is not 3 until finding a valueWhen Just continue to verifyObtain main promise

V verifies whether oneself is authorized receiver, and following i represents sender, and j represents recipient：

V judges equation R_j=H₃(S′_j) whether set up.If set up, V is then a member in authorized receiver, and otherwise V is put Abandon solution label close.

step2:Verify the correctness of message and obtain message.

For the actual close person i of label, 1≤i≤t, authorized receiver V passes through equation below：

F (x)=ι₁ ⁽ⁱ⁾+ι₂ ⁽ⁱ⁾x+…+ι_τ ⁽ⁱ⁾x^τ-1+x^τ

Obtain the close person i of actual label secret parameter f (S '_j)=u '_i, and non authorized recipients are correct due to that can not obtain S′_jAnd the secret parameter of decryption can not be obtained.V is by being calculated as below：

(γ′_i||M′_i)=H₄(u′_i)⊕W_i

Obtain signing the close cleartext information M ' of close user i label_i, but can't now verify whether message is correct.V is calculatedAnd verifyWhether set up.If set up, V receives the cipher-text message, clear-text message For M=M '₁||M′₂||…||M′_t.Otherwise V refuses the ciphertext.

The beneficial effects of the invention are as follows：The algorithm of key pair of this method comprising generation systematic parameter and each user KeyGen, the close algorithm Signcrypt of label conciliate the close algorithm Designcrypt of label.The finite field F that close algorithm feature based is q is signed, N+ τ participants, including N number of close person of label and the τ close person (N >=t) of solution label are had in system, close person's set is signed and conciliates label Mi Zheji Conjunction is not occured simultaneously.This method one leader L of selection from actual label close person, the actual close person of label is carried out with the key of oneself to message Label are close.In order to hide the identity of the close person of actual label, leader L can calculate interference data, and these data are that L is not knowing non-reality Sign in the case of the key of close person and to calculate what is obtained for each non-actual close person of label.Disturb the true number of data and the actual close person of label According to mixing, allow recipient can not judge the identity of the close person of actual label.The present invention ensure that sender using threshold technique Anonymity；The list of identities of recipient is no longer directly given in communication data, it is ensured that recipient's anonymity and judge in advance Property；The information fusion of the close key message of label and authorized receiver will be solved into a parameter list, it is ensured that understand label Migong and put down Property.

The present invention is elaborated with reference to the accompanying drawings and detailed description.

Brief description of the drawings

Fig. 1 is the flow chart of the invention based on multivariable, the multi-receiver label decryption method of many security attributes.

Fig. 2 is the flow chart of the inventive method embodiment.

Embodiment

Reference picture 1-2.Multi-receiver label decryption method of the invention based on multivariable, many security attributes is comprised the following steps that：

Explanation of nouns：

pk_i：User i public key, wherein i are positive integer；

sk_i：User i private key；

l：Positive integer；

F：Rank is 2 finite field；

G:Multiple variant equation P polar form；

Fⁿ：N-dimensional vector space on finite field F；

F^m：M gts on finite field F；

u：A n-dimensional vector on finite field F；

v：A n-dimensional vector on finite field F；

w：A n-dimensional vector on finite field F；

L：The leader selected in the actual close person of label；

V：Recipient；

Params：System public parameter；

*：Represent random length；

ο：Composition operation symbol between mapping；

mod：Modulo operation is accorded with；

||：Linked operation is accorded with；

⊕：Step-by-step xor operation is accorded with, i.e., XOR operation is accorded with；

Z_q*：The vector of random length in the finite field that rank is q；

q：Positive integer, the exponent number of finite field is represented in finite field only containing q element；

t：Positive integer, represents the close person's number of actual label；

N：Sign close person's quantity, including the actual close person of label and the actual close persons of label of non-；

τ：Positive integer, represents the number of authorized receiver；

M：Clear-text message；

M_i：I-th of close person of label signs close message blocks；

Com：Promise to undertake function；

ω：The security parameter of Com functions；

φ：The length of Com function input parameters；

X：The input parameter of Com functions；

r：Length is φ binary vector；

y：Length is ω binary vector；

h₅：The Hash functions avoided are collided, the string of binary characters that can be φ by length is calculated as two that length is ω and entered Character string processed；

H₆：The Hash function groups avoided are collided, the string of binary characters that can be φ by length is calculated as two that length is m+n System character string；

h₆：H₆In a Hash function.

c：A part for Com functions output, c=(h₆,y)。

d：A part for Com functions output, d=r.

r′：Length is φ binary vector

Γ_i：The F of user i selectionsⁿ→FⁿOn reversible affine transformation, the structure for hiding centralizing mapping；

△_i：The F of user i selections^m→F^mOn reversible affine transformation, the structure for hiding centralizing mapping；

The F of user i selectionsⁿ→F^mCentralizing mapping；

P_i：A part for user's i public keys.

z_i：User i is with the public key of oneself to s_iResult of calculation, i.e. z_i=P_i(s_i)；

H₀：The string of binary characters of random length, can be calculated as the binary-coded character that length is l by one-way hash function String；

H₁：The string of binary characters of random length, can be calculated as the character string that length is k, character by one-way hash function The element of string is 0,1,2,3；

H₂：One-way hash function, can be calculated as q rank Arbitrary Blocklength in Finite Fields by the string of binary characters that length is l+m Hashed value；

H₃：One-way hash function, can be calculated as q rank finite fields by the character string of long q ranks Arbitrary Blocklength in Finite Fields and take up an official post The hashed value for length of anticipating；

H₄：One-way hash function, can be calculated as length by the character string of q rank Arbitrary Blocklength in Finite Fields | n+M/t | String of binary characters；

s_i：A part in user's i private keys, a n-dimensional vector based on finite field F；

x：s_i=(s_1i,s_2i,…,s_ni) in from the subscript value of right first component being not zero of turning left；

f_j：User i equation groupIn j-th of equation, wherein j be positive integer；

Represent Equation f_jIn x-th of monotropic quantifier coefficient；

s_x：s_i=(s_1i,s_2i,…,s_ni) in subscript value be x component；

User i'sJ-th of component；

k：Each sign the number of the parameter group of close person, it is necessary to meet

A n-dimensional vector in i-th group of parameter tuple, the vector is based on finite field F；

A m dimensional vector in i-th group of parameter tuple, the vector is based on finite field F；

γ_i：Sign the string of binary characters that the length of close user i selections is n；

Using in i-th group of parameterWhen obtained commitment value；

The actual close person i of label uses parameter γ_iWith message blocks M_iCalculate the binary vector that obtained length is l；

θ_i：It is the component in every group of promise for sign close user iSet；

It is the component in every group of promise for sign close user iSet；

π_i：It is the component in every group of promise for sign close user iSet；

θ_i,j：It is the θ for signing close user i_iJ-th of component, i.e. i's

It is the close user i of labelJ-th of component, i.e. i's

π_i,j：It is the π for signing close user i_iJ-th of component, i.e. i's

Φ_i：Use H₀To i-th of all close users of labelCarry out Hash and calculate obtained value；

Ψ_i：Use H₀To i-th of all close users of labelCarry out Hash and calculate obtained value；

Λ_i：Use H₀To i-th of all close users of labelCarry out Hash and calculate obtained value；

γ：Use H₀To all actual close persons' of labelCarry out Hash and calculate obtained value；

By H₀The main commitment value obtained after calculating, is the binary vector that a length is l；

Use H₁The challenging value obtained after calculating, is a k dimensional vector, and the vectorial element is 0,1,2,3；

Challenge vectorI-th of element value；

ζ_i：Sign close user i response；

ζ_i,j：Sign j component of close user i response；

The set of the jth group response of all close users of label；

Main response, kSet；

Q_i：For recipient i on finite field F randomly selected m dimensional vectors；

To Q_iThe value obtained after encryption；

S_i：Use H₂Promised to undertake to mainWith parameter Q_iCalculate obtained value；

R_i：Use H₃To S_iCalculate obtained value；

U：The set associative of parameter；

u_i：The secret parameter of the actual close person i selections of label, is the character string of random length on finite field F；

W_i：The actual close person i of label is to message M_iBlocking message after encryption；

W：All W_iSet；

f(x)：Variable is x polynomial function；

ι_j ⁽ⁱ⁾：The parameter for the f (x) that the actual close person i of label is calculated, containing authorized receiver's identity information, recipient can be with The secret parameter decrypted with the gain of parameter；

η_i：The actual close person i of label ι_j ⁽ⁱ⁾Set；

C：Message ciphertext；

The main commitment value that recipient calculates；

Γ^-1：Map Γ inverse operation；

△^-1：Map △ inverse operation；

Q′_j：Verifier coupleThe size obtained after decryption is m vector；

S′_j：The value containing recipient information that verifier obtains；

γ′_i：Length is n string of binary characters；

Recipient usesWhen obtained commitment value；

Length is l binary vector；

Φ′_i：Recipient uses H₀To i-th of all close users of labelCarry out Hash and calculate what is obtained Value；

Ψ′_i：Recipient uses H₀To i-th of all close users of labelCarry out Hash and calculate what is obtained Value；

Λ′_i：Recipient uses H₀To i-th of all close users of labelCarry out Hash and calculate what is obtained Value；

γ′：Recipient uses H₀To all actual close persons' of labelCarry out Hash and calculate obtained value；

u′_i：The secret parameter for the close person i of actual label that recipient obtains；

M′_i：The Plaintext block that recipient calculates, the Plaintext block is actually signed close person i encryptions.

The present embodiment proposes a close side of multi-receiver label that can be suitably used for low side devices based on multivariable encryption system Method, to tackle privacy and safety problem present in existing multi-receiver stopover sites.The present embodiment meet sender anonymity, Recipient's anonymity, in advance judgement property conciliate label Migong levelling.The technology mainly used have multivariable equation polar form, Zero-knowledge proof, threshold technique.

One recipient receive first determined whether after ciphertext message source it is whether legal and oneself whether be authorize receive Person, only authorized receiver could decrypt message with the private key of oneself.As shown in Fig. 2For verifying the conjunction of informed source Method, R+Q is used to judge whether recipient is legal.ι₁,…,ι_τOnly it is authorized to recipient and uses the key that can be just decrypted Information, is obtained after key message, recipient could solve the correctness signed close message and verify message by W+ γ.Embody this The main information that ciphertext is included in stopover sites.Once the part error of ciphertext, whole ciphertext is destroyed.

The present embodiment is in order to judge that the legitimacy of informed source employs zero-knowledge proof technology, zero-knowledge proof process bag Include three parts：Promise to undertake, challenge and respond.Zero-knowledge proof technology is related to two sides, sender and recipients.Sender gives first One commitment value of recipient, then recipient give sender one challenging value, sender according to challenging value to recipient send one Individual response, last recipient verifies the relation between this response and commitment value, if there is certain specific relation, that Recipient demonstrates message and comes from sender, otherwise it is assumed that the informed source is unreliable.

Calculating in the present embodiment uses the polar form of multiple variant equation, and the polar form has two-wire Property attribute.Multiple variant equation P：Fⁿ→F^m(wherein m, n are positive integer, FⁿIt is the n-dimensional vector space on finite field F, F^mIt is M gts on finite field F, and have m<N) and shown in its polar form G relation such as formula (1), G bilinearity Shown in attribute such as formula (2), wherein u, v and w are taken from finite field F vector, and their dimension is n, i.e. u, v, w ∈ Fⁿ.G and P output result is the space vector of the m dimensions based on finite field F.

G (u, v)=P (u+v)-P (u)-P (v) (1)

G (u+v, w)=G (u, w)+G (v, w) (2)

The present embodiment includes three algorithms：KeyGen, Signcrypt and Designcrypt.Wherein KeyGen is generation system The algorithm of the key pair of parameter of uniting and each user, Signcrypt is the close algorithm of label, and Designcrypt is the close algorithm of solution label.Should Sign and N+ τ participants are had in the finite field F that close system feature based is q (wherein q=2), system, including the N number of close person of label (label Close person includes t actual individual non-actual close person of label of the close person of label and (N-t)) and the τ close person (N >=t) of solution label, sign close person gather with The close person's set of solution label is not occured simultaneously.Scheme one leader L of selection from reality label close person, reality signs close person with the key pair of oneself It is close that message carries out label.In order to hide the identity of the close person of actual label, L can calculate interference data, and these data are that L is not knowing non- Calculate what is obtained in the case of the key of the actual close person of label for each non-actual close person of label.Data and reality is disturbed to sign the true of close person Real data is mixed, and allows recipient can not judge the identity of the close person of actual label.We are called at the process of L calculating interference data L is the non-actual close person's analogue data of label.Threshold technique is used herein.

There is a vector s ∈ in multiple variant equation P, private key in this example, it is assumed that existing in the public key of user Fⁿ.S is divided into two parts r₀∈FⁿAnd r₁∈Fⁿ, i.e.,：S=r₀+r₁.According to formula (1), there are P (r₀+r₁)=P (r₀)+P(r₁)+ G(r₀,r₁), in order to prevent s from being known by other users, user can not provide r simultaneously₀And r₁.By r₀It is divided into two parts t₀∈Fⁿ And t₁∈Fⁿ, G (r are had according to the bilinearity attribute of polar form₀,r₁)=G (t₀,r₁)+G(t₁,r₁).Define e₁∈F^mAnd e₀= P(r₀)-e₁(e₀∈F^m), so P (s)=G (t₀,r₁)+e₀+P(r₁)+G(t₁,r₁)+e₁.The equation can be seen as two parts G (t₀,r₁)+e₀With P (r₁)+G(t₁,r₁)+e₁, it is seen that parameter group is divided into two parts (t₀,r₁,e₀) and (t₁,r₁,e₁), from each portion Complete s can not be all obtained in point.

KeyGen：Produce user i (i=1 ..., N) public key pk_iWith private key sk_i.System is in the t actual close person's group of label Into colony in select a leader L, be t blocks by whole clear-text message M point.Select a Com function and five Hash letters Number：Com：Fⁿ||F^m→F^o(n>M, | | it is cascade symbol, Com functions meet statistics and hidden and bind calculation attribute, the tool of function Body calculating process is shown in algorithm 1, is typically chosen o=128), H₀：{0,1}*→{0,1}^l, H₁：{0,1}^*→{0,1,2,3}^k, H₂： {0,1}^l+m→Z_q*, H₃：Z_q*→Z_q*, H₄：Z_q*→{0,1}^n+M/t.Systematic parameter is obtained for params=(H₀,H₁,H₂,H₃,H₄, q,Com)。

The present embodiment is using in multivariate public key cryptography system HFE (Hidden Fields Equations) multivariable Heart mapping structure, its kernel kernal mapping F is Fⁿ→F^m(m<N) the multivariable polynomial group on, shown in its structure such as formula (3).User i Select a transformation equation groupThe reversible affine transformation Γ of simultaneous selection two_i∈FⁿAnd △_i∈F^m.In the scheme of the present embodiment In, it is desirable to user i selection random vectors s_i∈Fⁿ, user i private key isMeetAndIn be free of Constant term (method for meeting this requirement is shown in algorithm 2).As long as such s_i=0 can just meetThe leader L is facilitated to be The non-actual close person's simulated operation of label.User i public key includes two parts, and Part I is(its Middle ο is the composite symbol of mapping), Part II is z_i=P_i(s_i).User i public key is (P_i,z_i)。

Algorithm 1 (how Com functions, which are realized, is hidden statistics and bind calculation function)：

Sender determines the length of the input parameter of Com functions.In the present embodiment, the length of the input parameter of Com functions For n+m, the input parameter of Com functions includes two parameters, and first parameter is the n-dimensional vector based on finite field F, second ginseng Number is the m dimensional vectors based on F.Definition input parameter is Χ.The security parameter that ω is Com functions is defined, φ=(n of 2 ω+2 are defined +m)+4.The Hash functions h avoided is collided in selection one₅：{0,1}^φ→{0,1}^ω, it is known that one is collided the function group H avoided₆： {0,1}^φ→{0,1,}^n+m.Com output includes two parts, is designated as c and d.C and d are sent to recipient by sender.h₅It is public The Hash functions opened.

D) sender random selection r ∈ { 0,1 }^φ, calculate y=h₅(r).

E) sender is from H₆Hash function groups in select a h₆∈H₆, meet h₆(r)=X.

F) Com is output as c=(h₆, y), d=r.

Algorithm 2 (ensuresAnd do not include constant term, this algorithm acquiescence in equationMonomial coefficient be 1)：

C) vectorial s of the system in user i_i=(s_1i,s_2i,…,s_ni) turn left searching first from the right side in (i=1 ..., N) The component for 0, variable x is assigned to by the subscript value of the component.System is that user i randomly chooses one with n variable and m The Polynomial equations of equationEquation group does not have constant term.CalculateNote nowValue differ be set to 0, it is necessary to according to process b) change equation groupThe coefficient of middle equation, untilEach component value be equal to 0 untill.

D) Equation f is selected from equation group successively_j(j=1 ..., m).SelectionJ-th of componentIfValue not be 0, according to formula (4) to f_jMake an amendment, untilValue be 0 untill.In formula (4)Expression side Journey f_jIn x-th of monotropic quantifier coefficient, s_xIt is s_i=(s_1i,s_2i,…,s_ni) in (i=1 ..., N) subscript value for x point Amount：

Signcrypt：Close process is signed, six steps are divided into.

step1:Calculate the commitment value of the close person of label.

The actual close person i of label selects k parameter tuple (r_i,t_j,e_m) (wherein i=0,1, j=0,1, m=0,1), Mei Gecan The value of number tuple is different from, and meets s_i=r₀ ^(j)+r₁ ^(j), r₀ ^(j)=t₁ ^(j)+t₀ ^(j),Wherein j= 1 ..., k, it is as follows.

Each actual close person of label calculates commitment value, the commitment value obtained using i-th group of parameter tuple using k group parameters tuple ForWithTheir computational methods are as follows：

Sign close person i selections γ_i={ 0,1 }ⁿ, then he is to message blocks M_iCalculated.HaveFinally sign Close person i will It is sent to L.

step2:L calculates main promise and challenging value.

L receives the commitment value of the close person of other t-1 label.L calculates the commitment value of oneself and basisPrinciple be N- The t non-close person's simulation commitment values of label.L calculates main promise after have collected the promise of each close user of labelBecause all label are close The same challenging value of users to shareSo L must be directed to each challenging value component, by all close user relevant positions of label Commitment value is arranged to together.Likewise, responseIt is also to be organized together according to the component of challenging value.Φ_j, Ψ_jWith Λ_jBe by the jth group commitment value taxonomic revisions of the close users of all label together.I.e. all close users' of label InIt is organized and obtains Φ together₁,It is organized and obtains together To Φ₂, the like, until all close users' of labelIt is organized and obtains Λ together_k.γ is the message of all close users of label BlockArrangement result.θ_i,jIt is the θ of the close user i of label (including actual and non-actual close person of label)_iJ-th of component, Sign close user i'sIt is the close user i of label (including actual and non-actual close person of label)J-th of component, that is, sign Close user i'sπ_i,jIt is the π of the close user i of label (including actual and non-actual close person of label)_iJ-th of component, that is, sign close user I'sWherein j=1 ..., k, i=1 ..., N.

Φ_j=H₀(θ_1,j||...||θ_N,j)

Λ_j=H₀(π_1,j||...||π_N,j)

The main promise of all senders

L uses H₁To the promise receivedWithHash calculating is carried out, challenge vector is obtained(i.e.Tieed up for k The vector of vector space).

L willIt is sent to remaining the t-1 close person of label.

step3:Sign close person and calculate response.

The response for signing close person i is ζ_iοζ_iJth position component ζ_i,j(1≤j≤k) is according to challenging valueJth position componentCalculate what is obtained.According toValue,Jth position componentFor 0,1,2 actual close user i of label need to use oneself the J group parameter member set constructor response components ζ_i,j.Calculating process is as follows：

Ifζ_i,j=(r₀ ^(j),t₁ ^(j),e₁ ^(j))

Ifζ_i,j=(r₁ ^(j),t₁ ^(j),e₁ ^(j))

Ifζ_i,j=(r₁ ^(j),t₀ ^(j),e₀ ^(j))

WhenFor 3 when represent to skip calculating group response.Close person i is finally signed ζ_i=(ζ_i,1,ζ_i,2,…,ζ_i,k) hair Give L (ζ herein_iThere is k component, this is that situation when element is 3 is not present in challenging value, because working asDuring equal to 3, it is necessary to Skip this group of response component of calculating.IfIt is middle to there is the component that x value is 3, ζ_iComponent number then be k-x.In the present embodiment Middle acquiescence ζ_iThere is k component).

step4:L calculates main response value and specifies recipient.

L calculates the response of oneself, and collects the response that other t-1 signer is sent.The non-actual label of simulation N-t The response of close user.L calculates main responseIt isJ-th of component, it is j-th of component according to challenging valueMeter Obtain, wherein (1≤j≤k).

If

IfCorresponding response is not calculated.

Assuming that there is τ recipient.For recipient i, L random selections Q_i∈F^m(1≤i≤τ) is simultaneously calculated as below：

R_i=H₃(S_i)

Here S_iAnd R_iIt is to be calculated for each authorized receiver, recipient can only be according to S_iAnd R_iOneself could be judged Whether it is authorized to.L arranges the identity information of sender and recipients to together, is designated as U.

The close person i of reality label (i=1 ..., t) select a secret parameter u_i∈Z_q*, the secret parameter is used for encrypting message, Only authorized receiver could obtain this secret parameter.The actual close person i of label uses u_iMessage is encrypted, ciphering process is as follows：

W_i=H₄(u_i)⊕(γ_i||M_i)

In order to reach that only authorized receiver could obtain secret parameter, the actual close person i of label uses all authorized receivers The information at family and the secret parameter are stashed by following mode.

The actual close person i of label obtains parameter listIt is actual to sign close person i by (W_i,η_i) it is sent to L.

step6:L arranges the label confidential information of all close person users of label and is sent to verifier.

The close message coalescing of all label being collected into together, is finally obtained message ciphertext C by L.Have：

W=(W₁,…,W_t)

R=(R₁,…,R_τ)

C=(R, U, η₁,…,η_t,W)

Designcrypt:The close process of solution label, is divided into two steps.

step1:Verify the legitimacy of recipient.

Recipient V is received after ciphertext C, according to challenging value componentObtain N group commitment valuesWith(i=1 ..., N).The following three kinds of situations of calculating process point：

When the jth position component of challenging valueBe worth for 0 when, V can only be from main responseJth position componentIn Obtain N group parameters r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾(wherein i=1 ..., N, main responseInclude k component, each componentInclude N The response of individual sender).Recipient V uses i-th group of data r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾(i=1 ..., N) be calculated as below To the commitment value for signing close user iWith

V-arrangement is into the responses of the close users of all label, Ψ '_jIt is basisTo allThe Hash knots of calculating Really, Λ '_jIt is basisTo allThe Hash results of calculating, are shown below.

WhenBe worth for 1 when, V can only be fromIn obtain N group parameters r₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾(i=1 ..., N).V is close using signing User i data r₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWith

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allThe Hash knots that (i=1 ..., N) is calculated Really.Λ′_jIt is basisTo allThe Hash results that (i=1 ..., N) is calculated.

WhenBe worth for 2 when, V can only be fromIn obtain N group parameters r₁ ⁽ⁱ⁾, t₀ ⁽ⁱ⁾, e₀ ⁽ⁱ⁾(wherein i=1 ..., N), V uses the data r for signing close user i₁ ⁽ⁱ⁾, t₀ ⁽ⁱ⁾, e₀ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWithIt is calculated as follows：

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allThe Hash knots that (i=1 ..., N) is calculated Really.Ψ′_jIt is basisTo allThe Hash results of calculating.

WhenBe worth for 3 when, recipient stop checkingJudge next bitValue, until looking for It is not 3 to a valueWhen just continue verifyObtain main promise

step2:Verify the correctness of message and obtain message.

For the actual close person i (1≤i≤t) of label, authorized receiver V passes through equation below：

F (x)=ι₁ ⁽ⁱ⁾+ι₂ ⁽ⁱ⁾x+…+ι_τ ⁽ⁱ⁾x^τ-1+x^τ

(γ′_i||M′_i)=H₄(u′_i)⊕W_i

It can obtain signing the close cleartext information M ' of close user i label_i, but can't now verify whether message is correct.V is calculatedAnd verifyWhether set up.If set up, V receives the cipher-text message, Clear-text message is M=M '₁||M′₂||…||M′_t.Otherwise V refuses the ciphertext.

Claims

1. a kind of multi-receiver label decryption method based on multivariable, many security attributes, it is characterised in that comprise the following steps：

Step 1: producing user i public key pk by KeyGen algorithms_iWith user i private key sk_i, wherein i=1 ..., N；System A leader L is selected in the colony of the actual close person's composition of t label, is t blocks by whole clear-text message M points；Selection one Com functions and five Hash functions, Com：Fⁿ||F^m→F^o, n>M, | | it is cascade symbol, FⁿIt is the n-dimensional vector sky on finite field F Between, F^mIt is the m gts on finite field F, Com functions meet statistics and hidden and bind calculation attribute, select o=128；H₀： {0,1}*→{0,1}^l, H₁：{0,1}^*→{0,1,2,3}^k, H₂：{0,1}^l+m→Z_q*, H₃：Z_q*→Z_q*, H₄：Z_q*→{0,1 }^n+M/t, Z_q* it is the vector of random length in the finite field that rank is q；Systematic parameter is obtained for params=(H₀,H₁,H₂,H₃,H₄, q,Com)；The detailed process of function is as follows,

The hiding statistical attribute of Com functions represents output result that different input parameter obtains after the calculating of Com functions not Together, and result is for recipient's undistinguishable；The bind calculation attribute of Com functions represents that input data is calculated by Com functions Obtain after output result, sender can not deny the value of input data；

Sender determines the length of the input parameter of Com functions；The length of the input parameter of Com functions is n+m, Com functions Input parameter includes two parameters, and first parameter is the n-dimensional vector based on finite field F, and second parameter is the m dimensions based on F Vector；Definition input parameter is X；The security parameter that ω is Com functions is defined, φ=(n+m)+4 of 2 ω+2 is defined；Selection one Collide the Hash functions h avoided₅：{0,1}^φ→{0,1}^ω, it is known that one is collided the function group H avoided₆：{0,1}^φ→{0,1, }^n+m；Com output includes two parts, is designated as c and d；C and d are sent to recipient by sender；h₅It is disclosed Hash functions；

A) sender random selection r ∈ { 0,1 }^φ, calculate y=h₅(r).

B) sender is from H₆Hash function groups in select a h₆∈H₆, meet h₆(r)=X；

C) Com is output as c=(h₆, y), d=r；

Recipient verifies y=h₅And h (r)₆(r)=X, due to h₆And h₅All it is the function that collision is avoided, therefore in the absence of a satisfaction h₆(r ')=X and y=h₅The r ' of (r ')；Sender can not deny X；

User i selects a transformation equation groupThe reversible affine transformation Γ of simultaneous selection two_i∈FⁿAnd Δ_i∈F^m；It is required that user I selection random vectors s_i∈Fⁿ, user i private key isMeetAndIn be free of constant term, specifically Method is as follows；

A) vectorial s of the system in user i_i=(s_1i,s_2i,…,s_ni) in find the component that first is not 0 from right turn left, by this The subscript value of component is assigned to variable x；System is that user i randomly chooses a polynomial equation with n variable and m equation GroupEquation group does not have constant term；CalculateNowValue differ and be set to 0, need To change equation group according to process b)The coefficient of middle equation, untilEach component value be equal to 0 untill；

B) Equation f is selected from equation group successively_j, j=1 ..., m；SelectionJ-th of componentIf Value not be 0, according to below equation to f_jMake an amendment, untilValue be 0 untill；In below equationRepresent Equation f_jIn The coefficient of x-th of monotropic quantifier, s_xIt is s_i=(s_1i,s_2i,…,s_ni) in subscript value be x component：

Value be changed into after 0, next equation is selected, using formulaChange the coefficient of equation, until equation group In all equations all meet after requirement, stop aforesaid operations；

As long as s_i=0 can just meetIt is the non-actual close person's simulated operation of label to facilitate leader L；User i public key includes Two parts, Part I isWhereinIt is the composite symbol of mapping, Part II is z_i=P_i(s_i)；User i Public key be (P_i,z_i)；

Step 2: signing close process using Signcrypt, six steps are divided into；

step 1:Calculate the commitment value of the close person of label；

The actual close person i of label selects k parameter tuple (r_i,t_j,e_m), wherein i=0,1, j=0,1, m=0,1, each parameter tuple Value be different from, meet s_i=r₀ ^(j)+r₁ ^(j), r₀ ^(j)=t₁ ^(j)+t₀ ^(j),It is as follows；

Sign close person i selections γ_i={ 0,1 }ⁿ, then to message blocks M_iCalculated, obtainedFinally sign close person i WillIt is sent to L；

step 2:Leader L calculates main promise and challenging value；

Leader L receives the commitment value of the close person of other t-1 label；Leader L calculates the commitment value of oneself and basisPrinciple For the N-t non-close person's simulation commitment values of label；Leader L calculates main promise after collecting the promise for each signing close userDue to all Sign the same challenging value of close users to shareSo leader L must be directed to each challenging value component, by all close user's phases of label The commitment value of position is answered to arrange to together；Likewise, responseIt is also to be organized together according to the component of challenging value； Φ_j、Ψ_jAnd Λ_jBe by the jth group commitment value taxonomic revisions of the close users of all label together；I.e. all close users' of labelInIt is organized and obtains together Φ₁,It is organized and obtains Φ together₂, the like, until all close users' of labelIt is organized and obtains Λ together_k；γ It is the message blocks of all close users of labelI=1 ..., t arrangement result；θ_i,jIt is the θ for signing close user i_iJ-th of component, i.e., Sign close user i's It is the close user i of labelJ-th of component, that is, sign close user i'sπ_i,jIt is the close user i of label π_iJ-th of component, that is, sign close user i'sWherein j=1 ..., k, i=1 ..., N；

Φ_j=H₀(θ_1,j||...||θ_N,j)

Λ_j=H₀(π_1,j||...||π_N,j)

The main promise of all senders

Leader L uses H₁To the promise receivedWithHash calculating is carried out, challenge vector is obtainedI.e.Tieed up for k Vector in vector space；

Leader L willIt is sent to remaining the t-1 close person of label；

step 3:Sign close person and calculate response；

The response for signing close person i isJth position component1≤j≤k is according to challenging valueJth position componentCalculate Obtain；According toValue,Jth position componentFor 0,1 and 2, then sign close user i and need to use the jth group parameter member of oneself Set constructor response componentCalculating process is as follows：

If

WhenFor 3 when represent to skip calculating group response；Finally sign close person i handlesIt is sent to leader L, hereinThere is k component, this is situation when element 3 being not present in challenging value, because working as, it is necessary to skip calculating during equal to 3 This group of response component；IfIt is middle to there is the component that x value is 3,Component number then be k-x；Give tacit consent in the present inventionThere is k Individual component；

step 4:L calculates main response value and specifies recipient；

Leader L calculates the response of oneself, and collects the response that other t-1 signer is sent；The non-actual label of simulation N-t The response of close user；Leader L calculates main response It isJ-th of component, according to j-th of component of challenging valueCalculate Obtain；

If

IfCorresponding response is not calculated；

Assuming that there is τ recipient；For recipient i, L random selections Q_i∈F^m, 1≤i≤τ, and be calculated as below：

R_i=H₃(S_i)

Here S_iAnd R_iIt is to be calculated for each authorized receiver, recipient can only be according to S_iAnd R_iCould judge oneself whether by Authorize；Lead L to arrange the identity information of sender and recipients to together, be designated as U；

step 5:The actual close person of label calculates ciphertext and the identity information of recipient；

Actual label close person i, i=1 ..., t, select a secret parameter u_i∈Z_q*, the secret parameter is used for encrypting message, only Authorized receiver could obtain this secret parameter；The actual close person i of label uses u_iMessage is encrypted, ciphering process is as follows：

W_i=H₄(u_i)⊕(γ_i||M_i)

In order to reach that only authorized receiver could obtain secret parameter, the actual close person i of label authorizes solution to sign close user's by all Information and the secret parameter are stashed by following mode；

The actual close person i of label obtains parameter list η_i=(ι₁ ⁽ⁱ⁾,…,ι_τ ⁽ⁱ⁾)；It is actual to sign close person i by (W_i,η_i) it is sent to leader L；

step 6:Leader L arranges the label confidential information of all close users of label and is sent to verifier；

Lead L that together, the close message coalescing of all label being collected into is finally obtained into message ciphertext C；Have：

W=(W₁,…,W_t)

R=(R₁,…,R_τ)

C=(R, U, η₁,…,η_t,W)

Step 3: using the close process of Designcypt algorithm solution label, being divided into two steps；

step 1:Verify the legitimacy of recipient；

Recipient V is received after ciphertext C, according to challenging value componentJ=1 ..., k, obtain N group commitment values With I=1 ..., N；Three classes of calculating process point：

When the jth position component of challenging valueBe worth for 0 when, V can only be from main responseJth position componentIn obtain N group parameters r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾, main responseInclude k component, each componentInclude the response of N number of sender；Recipient V is used I-th group of data r₀ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWith

<mrow> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>1</mn> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msubsup> <mo>=</mo> <mi>C</mi> <mi>o</mi> <mi>m</mi> <mrow> <mo>(</mo> <msup> <msub> <mi>r</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>-</mo> <msup> <msub> <mi>t</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msub> <mi>P</mi> <mi>i</mi> </msub> <mo>(</mo> <mrow> <msup> <msub> <mi>r</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> </mrow> <mo>)</mo> <mo>-</mo> <msup> <msub> <mi>e</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>)</mo> </mrow> </mrow>

<mrow> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>2</mn> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msubsup> <mo>=</mo> <mi>C</mi> <mi>o</mi> <mi>m</mi> <mrow> <mo>(</mo> <msup> <msub> <mi>t</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msup> <msub> <mi>e</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>)</mo> </mrow> </mrow>

V-arrangement is into the responses of the close users of all label, Ψ '_jIt is basisTo allResult of calculation；Λ′_jIt is basisTo institute HaveResult of calculation；

<mrow> <msubsup> <mi>&Psi;</mi> <mi>j</mi> <mo>&prime;</mo> </msubsup> <mo>=</mo> <msub> <mi>H</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>1</mn> <mrow> <mo>(</mo> <mn>1</mn> <mo>)</mo> </mrow> </msubsup> <mo>|</mo> <mo>|</mo> <mo>...</mo> <mo>|</mo> <mo>|</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>1</mn> <mrow> <mo>(</mo> <mi>N</mi> <mo>)</mo> </mrow> </msubsup> <mo>)</mo> </mrow> </mrow>

<mrow> <msubsup> <mi>&Lambda;</mi> <mi>j</mi> <mo>&prime;</mo> </msubsup> <mo>=</mo> <msub> <mi>H</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>2</mn> <mrow> <mo>(</mo> <mn>1</mn> <mo>)</mo> </mrow> </msubsup> <mo>|</mo> <mo>|</mo> <mo>...</mo> <mo>|</mo> <mo>|</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>2</mn> <mrow> <mo>(</mo> <mi>N</mi> <mo>)</mo> </mrow> </msubsup> <mo>)</mo> </mrow> </mrow>

WhenBe worth for 1 when, V can only be fromIn obtain N group parameters r₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾；V uses the data r for signing close user i₁ ⁽ⁱ⁾, t₁ ⁽ⁱ⁾, e₁ ⁽ⁱ⁾Be calculated as below the commitment value for obtaining signing close user iWith

<mrow> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>0</mn> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msubsup> <mo>=</mo> <mi>C</mi> <mi>o</mi> <mi>m</mi> <mrow> <mo>(</mo> <msup> <msub> <mi>r</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msub> <mi>z</mi> <mi>i</mi> </msub> <mo>-</mo> <msub> <mi>P</mi> <mi>i</mi> </msub> <mo>(</mo> <mrow> <msup> <msub> <mi>r</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> </mrow> <mo>)</mo> <mo>-</mo> <msub> <mi>G</mi> <mi>i</mi> </msub> <mo>(</mo> <mrow> <msup> <msub> <mi>t</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msup> <msub> <mi>r</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> </mrow> <mo>)</mo> <mo>-</mo> <msup> <msub> <mi>e</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>)</mo> </mrow> </mrow>

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allResult of calculation；Λ′_jIt is basisTo institute HaveResult of calculation；

<mrow> <msubsup> <mi>&Phi;</mi> <mi>j</mi> <mo>&prime;</mo> </msubsup> <mo>=</mo> <msub> <mi>H</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>0</mn> <mrow> <mo>(</mo> <mn>1</mn> <mo>)</mo> </mrow> </msubsup> <mo>|</mo> <mo>|</mo> <mo>...</mo> <mo>|</mo> <mo>|</mo> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>0</mn> <mrow> <mo>(</mo> <mi>N</mi> <mo>)</mo> </mrow> </msubsup> <mo>)</mo> </mrow> </mrow>

<mrow> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>0</mn> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msubsup> <mo>=</mo> <mi>C</mi> <mi>o</mi> <mi>m</mi> <mrow> <mo>(</mo> <msup> <msub> <mi>r</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msub> <mi>G</mi> <mi>i</mi> </msub> <mo>(</mo> <mrow> <msup> <msub> <mi>t</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msup> <msub> <mi>r</mi> <mn>1</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> </mrow> <mo>)</mo> <mo>+</mo> <msup> <msub> <mi>e</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>)</mo> </mrow> </mrow>

<mrow> <msubsup> <mover> <mi>c</mi> <mo>&OverBar;</mo> </mover> <mn>1</mn> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msubsup> <mo>=</mo> <mi>C</mi> <mi>o</mi> <mi>m</mi> <mrow> <mo>(</mo> <msup> <msub> <mi>t</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>,</mo> <msup> <msub> <mi>e</mi> <mn>0</mn> </msub> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </msup> <mo>)</mo> </mrow> </mrow>

V-arrangement is into the responses of the close users of all label, Φ '_jIt is basisTo allResult of calculation；Ψ′_jIt is basisTo institute HaveResult of calculation；

WhenBe worth for 3 when, recipient stop checkingJudge next bitValue, is not 3 until finding a valueShi Caiji Continuous checkingObtain main promise

V judges equation R_j=H₃(S_j') whether set up；If set up, V is then a member in authorized receiver, and otherwise V abandons solution Label are close；

step 2:Verify the correctness of message and obtain message；

F (x)=ι₁ ⁽ⁱ⁾+ι₂ ⁽ⁱ⁾x+…+ι_τ ⁽ⁱ⁾x^τ-1+x^τ

Obtain the close person i of actual label secret parameter f (S_j')=u_i', and non authorized recipients are due to that can not obtain correct S_j' and The secret parameter of decryption can not be obtained；V is by being calculated as below：

(γ_i′||M_i')=H₄(u_i′)⊕W_i

Obtain signing the close cleartext information M of close user i label_i', but can't now verify whether message is correct；V is calculatedAnd verifyWhether set up；If set up, V receives the cipher-text message, clear-text message For M=M₁′||M₂′||…||M_t′；Otherwise V refuses the ciphertext.