CN109600233B

CN109600233B - Group signature label issuing method based on SM2 digital signature algorithm

Info

Publication number: CN109600233B
Application number: CN201910036016.0A
Authority: CN
Inventors: 马文平; 刘威; 刘小雪
Original assignee: Xidian University
Current assignee: Xidian University
Priority date: 2019-01-15
Filing date: 2019-01-15
Publication date: 2021-06-08
Anticipated expiration: 2039-01-15
Also published as: CN109600233A

Abstract

The invention provides a group signature label issuing method based on SM2 digital signature, which mainly solves the problems of low issuing and signature checking efficiency and difficult member revocation in the prior art, and the implementation scheme is as follows: initializing system parameters; key generation center generates group public key PK_GMAnd a group private key SK_GM(ii) a Group members apply for group entry and generate public and private key pair (SK)_A，PK_A) Intermediate amount of signature E_ASharing a symmetric key θ with the group; the group members use their own private key SK_AAnd intermediate quantity of signatures E_APerforming group signature on the message M; the verifier verifies whether the group signature identification is legal, if so, the group signature is finished, otherwise, the group administrator utilizes the group private key SK_GMOpening the ID of the signer_A(ii) a The group administrator selects a new group sharing symmetric key, and the revocation identity is ID_AA group member of (1). The invention has short key length, good safety performance and high signing and verifying efficiency, and can be used for realizing the signing and the verification of the group signature identifier of the information service entity under the alliance network system.

Description

Group signature label issuing method based on SM2 digital signature algorithm

Technical Field

The invention belongs to the technical field of network communication, and further relates to a group signature label issuing method which can be applied to group signature label issuing and authentication of information service entities under a alliance network system.

Background

Group digital signatures were proposed by d.chaum and e.van Heyst in 1991. Modified and improved by j.camenish, m.stadler, j.camenish, m.michels, g.ateniese, g.tsudik, and the like. In a group signature scheme, any member of a group can sign messages anonymously on behalf of the entire group. Like other digital signatures, group signatures are publicly verifiable and can be verified with only a single group public key. Because the group signature has the characteristics of privacy protection and traceability, the group signature plays an indispensable role in many fields such as modern electronic commerce, electronic currency, trusted computing, network evidence obtaining, internal organization architecture hiding, electronic election protocol and the like.

In order to meet the application requirements of an electronic authentication service system, the SM2 elliptic curve public key cryptographic algorithm is released by the national cryptographic authority in 12 th and 17 th 2010-month, and the SM2 signature algorithm in 11 th and 11 th 2018-month is released in the latest version along with ISO/IEC14888-3:2018, part 3 of digital signature with appendix in information security technology, namely mechanism based on discrete logarithm. In detail, the SM2 algorithm specifies specific details of signing, authentication, key exchange, etc.

A good group signature mark issuing scheme can not only safely and efficiently generate a group signature mark, but also safely and effectively eliminate group members, and can efficiently open the group signature mark to determine the true identity of a signer when disputes occur. Since the public keys of the group members have a one-to-one correspondence relationship with the real identities thereof, if the group members use the same public key to sign a message each time, an attacker can use the signature identifier to deduce whether the group signature identifier is signed by the same person, which cannot guarantee the non-relevance of the group signature identifier, and therefore the public key needs to be updated in each time period to ensure the non-relevance. However, updating the key at intervals results in the member needing to register to obtain the member certificate every time the member signs, which greatly reduces the efficiency of the group signature process. For example, in the article entitled "electronic cash system based on certificateless group signature scheme" published by zhang, in the communications newspaper of 2016, 5, published at volume 37, 5, an efficient certificateless group signature scheme is proposed, when a member is added in step 3.3, the member needs to send a newly generated secret key to a group manager each time, so that the signature process needs to be repeated each time, the calculation amount is greatly increased, and the signature efficiency is reduced.

The patent document "a verifiable encryption group signature method with anonymity" (application number CN201810198425.6, publication number CN108551435A) applied by the university of beijing aerospace discloses and realizes a verifiable encryption group signature method with anonymity. In the method, when a user determines to sign on a file, the user firstly registers in the system to obtain a signature key, and then generates a verifiable encrypted group signature by using the signature key and an arbitrator public key. The verifier can verify the validity of the signature without decrypting. The group administrator recovers the signer identity by using the tracking key, and the arbitrator recovers the original signature from the verifiable encrypted group signature, and the scheme has the following defects: revocation of a member cannot be efficiently performed, and when a group signature disputes or a group member is deceived in the signature process, a group administrator cannot immediately remove the user from the group, which results in that the member can continue to generate illegal group signatures on behalf of the entire group during this period.

Disclosure of Invention

The invention aims to provide a group signature identifier issuing method based on SM2 digital signature aiming at overcoming the defects of the prior art, so as to improve issuing efficiency on the premise of ensuring the anonymity of a signer, rapidly revoke members disputed or deceived during issuing and prevent illegal group signature identifiers from being generated.

In order to achieve the purpose, the scheme of the invention comprises the following steps:

(1) initializing parameters:

let F_qIs a finite field of order q; selecting an elliptic curve equation E as y²＝x³+ ax + b, where a, b ∈ F_q(ii) a Is provided with a limited area F_qThe set of all rational points of the upper elliptic curve equation E is E (F)_q) (ii) a Let base point G with order n on E be (x)_G,y_G) Wherein x is_G,y_GAs coordinates of a base point; cipher hash algorithm H with selected message length of v bits_v() (ii) a Choose secure hash function H: {0,1} → Z_GWherein Z is_GSelecting a symmetric encryption algorithm E (), which is an integer value of a base point G;

(2) random selection of key generation center KGC

As a group private key, wherein

Is an integer string of order q and private keys SK to the group_GMAnd the product of base point G as the group public key: PK_GM＝SK_GMG；

(3) Group member a joined the group:

(3.1) Key Generation center KGC generates public and private Key Pair (SK) for group Member A_A，PK_A) The group member A sends identity Information (ID)_A,PK_A) Sent to the group Administrator GM through a secure channel, wherein the ID_AFor group member A true identity, PK_ABeing the public key of group member A, SK_AA private key that is a group member a; the group administrator GM associates the identity Information (ID) of the group member A_A,PK_A) Storing the data into a group member information list and calculating a group signature intermediate quantity E_AAnd then E is transmitted through a secure channel_ASending the information to a group member A;

(3.2) group Administrator GM first selects a polynomial

Where t is the total number of group members, x_iIs the pseudonym of the ith group member, theta is the group shared symmetric key, (C)₀,C₁,…,C_t-1) Is as follows; then, the omega multiple point W of base point G on the elliptic curve is calculated as omega G, and the pseudonym x of group member A_AAnd disclosing the W point and the polynomial parameter within a group, wherein t is the number of group members;

(3.3) group Member A based on the received parameter (C)₀,C₁,…,C_t-1) Calculating a group sharing symmetric key theta;

(4) the group member a signs the message M:

(4.1) group Member A sends symmetric ciphertext E_θ(ID_A,PK_A,TT) group administrator GM, where PK_A,TIs a temporary public key of group member A, T is a time stamp of the current time, E_θ() A symmetric encryption algorithm;

(4.2) group Administrator GM receives ciphertext E_θ(ID_A,PK_A,TAnd T) then using the secret key theta to decrypt, and if the decryption is successful and the time stamp T is valid, the identity Information (ID) of the member A can be obtained_A,PK_A,TT), execution of stepStep (4.3), otherwise, terminating the signature;

(4.3) group Member A generates a random number k e [1, n-1 ∈]Where n is the order of the base point G, and calculating the point K on the elliptic curve as (x)₁,y₁)＝[k]G, wherein x₁,y₁The horizontal and vertical coordinates of the calculated point are obtained;

(4.4) group Member A selects three random numbers

And using the message M to be signed, the group public key PK_GMAnd the temporary private key SK of the group member A_A,TOutputting the group signature identifier as (c, s) through a probability algorithm₁,s₂,s₃,T_A,TR, s), where c is a hash function on the temporary public key PK_A,TAnd a group public key PK_GMOf the hash value s₁Is a first random number r₁Blind value of s₂Is a second random number r₂Blind value of s₃Is a third random number r₃And a temporary private key SK_A,TBlind value of, T_A,TSK is private key of member_A,TIntermediate quantity E to signature_AR is the abscissa x of the point of the elliptic curve₁The obtained remainder value s is the group public key PK_GMFor random number r₁,r₂,r₃(ii) a blinded value of;

(5) identifying (c, s) the group signature₁,s₂,s₃,T_A,T,PK_A,TR, s) verify:

(5.1) the verifier B firstly verifies whether r belongs to [1, n-1], s belongs to [1, n-1], if yes, the step (5.2) is executed, otherwise, the group signature identification is illegal, and the step (6) is executed;

(5.2) the verifier B calculates the hash value e ' and the verification intermediate quantity t ' of the message M to be signed in turn, and calculates an elliptic curve point (x '₁,y′₁)＝(s₁+s₃)^-1(s-t '), and a proof value of R ═ e ' + x '₁) mod n, where x'₁,y′₁Mod n represents a modulo operation of dividing an integer by n for the abscissa and ordinate of the elliptic curve point;

(5.3) verifying whether R is true or not by the verifier B, if so, judging that the group signature identifier is legal, ending the group signature process, otherwise, judging that the group signature identifier is illegal, and executing (6);

(6) the group administrator GM extracts the member private key SK from the group signature identification_A,TIntermediate quantity E to signature_AIs encrypted value T_A,TUsing the group private key SK_GMAnd the temporary public key PK of the group member A_A,TCalculating the public key PK of the signer_AAnd then through group membership Information (ID) stored in a membership information list_A,PK_A) Group member true identity ID with tracked to signature_AExecuting (7);

(7) the group master GM selects a new group-shared symmetric key

Generating a new polynomial f (x)', calculating the real identity ID of the group member except the tracked signature_APseudonyms x of the remaining t-1 group members outside_iAnd new polynomial parameters (C)₀′,C₁′,…C_t-1') public so that the identity is tracked as an ID_AThe group member of (1) will not be able to compute a new group-shared symmetric key from the parameter and therefore not be able to sign, at which point the group member is revoked.

Compared with the prior art, the invention has the following advantages:

firstly, the SM2 digital signature algorithm is applied in the process of signing the message M to be signed by the group member A, so that the group signature identifier can carry the identity information of a signer, the difficulty of other people for generating illegal group signature identifiers by counterfeiting the identity of the signer is increased, the signature process is ensured to be safer, meanwhile, the group signature algorithm is established on the elliptic curve model, the length of a secret key generated in the secret key generation process is shortened, the length of the secret key is not influenced by the number of the group members, and the signing, issuing and verifying processes of the group signature identifiers are more efficient on the premise of ensuring higher security.

Secondly, because the group member A uses the temporary key to sign in the signing process, the invention ensures that the group member A signs by using the temporary keyThe method has the advantages that the group members except the group manager GM cannot judge whether two different signatures are signed by the same person through the temporary public key, so that the non-relevance and the forward security of the group signature identification are improved; meanwhile, in order to realize traceability, an intermediate quantity E of group signatures is introduced_AEnabling the group administrator GM to base the identity Information (ID) of the group member A_A,PK_A) Generating time invariant group signature intermediate quantities E_AThe method avoids the registration procedure of the group members before each group signature, and improves the signature efficiency.

Thirdly, since the group member obtains the group sharing symmetric key in a secret sharing manner when the group member registers in the present invention, the group administrator GM only needs to reselect the group sharing symmetric key θ' and broadcast the new polynomial parameter (C) when the group member revokes₀′,…,C₁′,C_t-1') and other group members can continue to calculate a new group shared symmetric key according to the received parameters and represent the whole group to carry out signature, thereby overcoming the trouble that the group public key needs to be replaced and the group members need to be registered again when the members are revoked in the prior art, and improving the efficiency of revoking the group members.

Drawings

FIG. 1 is a flow chart of an implementation of the present invention.

Detailed Description

The invention is further described below with reference to fig. 1.

Referring to the figure, the implementation steps of the example are as follows:

step 1, initializing parameters.

(1.1) setting F_qIs a finite field of order q, where q is an odd prime number or a power of 2, and when q is an odd prime number, q is required>2¹⁹¹(ii) a When q is 2 raised to the power of 2^mWhen it is required for m>192 and is a prime number, when q is an odd prime number, the elements in the prime field are represented by the integers 0,1,2 …, q-1; when q is 2 raised to the power of 2^mTime, binary extension

F of order 2₂M-dimensional vector space of (1), its elements being available longBit string representation with degree m;

(1.2) selecting a finite field F_qThe elliptic curve equation E is:

y²＝x³+ax+b， <1>

wherein the parameters a and b of the elliptic curve are belonged to F_qAnd (4 a)³+27b²) mod q ≠ 0, where mod q represents a remainder operation of an integer divided by q;

(1.3) setting a limit F_qThe set of all rational points of the upper elliptic curve equation E is E (F)_q) Wherein E (F)_q)＝{(x,y)|x,y∈F_qAnd satisfy the equation<1>} U { O }, where O is an infinity point;

(1.4) setting a limit F_qThe base point G of the order n on the elliptic curve equation E is (x)_G,y_G) Wherein x is_G,y_GIs the horizontal and vertical coordinates of the base point;

(1.5) selecting a cryptographic hash algorithm H with the message length of v bits_v(Z), wherein v denotes a length of the message digest, the cryptographic hash algorithm, and Z denotes the message digest;

(1.6) selecting a symmetric encryption algorithm E ().

And 2, the key generation center generates a group public key and a group private key.

Random selection of key generation center KGC

As a group private key, wherein

And 3, applying for joining the group by the group members.

(3.1) when the group member A applies for group entry, the group manager GM first selects a random number

As the private key of group member A, and calculates the group memberA public key PK_A＝SK_AG, wherein G is the base point of the elliptic curve, and then the group member A couples the public and private keys (SK) through the secure channel_A，PK_A) Sending the public key information to a group member A, and after receiving the public and private key pair of the group member A, sending the identity and the public key Information (ID) of the group member A_A,PK_A) Sent to the group Administrator GM through a secure channel, wherein the ID_AThe group manager receives the identity public key information and stores the identity public key information into a group member information list for the real identity of the group member A;

(3.2) group Administrator GM selects the intermediate random number of group signature

And calculating the intermediate quantity E of the group signature by using the following formula_A：

E_A＝(SK_GM+PK_A)·γ^-1 <2>

Wherein SK_GMIs a group public key, PK_AIs the public key of the group member A, after which the group administrator GM sends E over a secure channel_ASending the information to a group member A;

(3.3) the group administrator GM selects a polynomial:

where t is the total number of group members, x_iIs the pseudonym of the ith group member, theta is the group shared symmetric key;

(3.4) the group administrator GM calculates ω -times the base point G on the elliptic curve, and discloses the W point in the group, and calculates the pseudonym x of the group member a using the following formula_A：

x_A＝H(ID_A||ωPK_A) <4>

Where H () is a hash function, ID_AIs the true identity, PK, of group member A_AIs the public key of group member A;

(3.5) the group Administrator GM will calculate the pseudonym x of the group Member A_AIs brought into the selected polynomial f (x) to obtainThe following equation:

wherein (C)₀,C₁,…,C_t-1) A parameter that is a polynomial; the group administrator GM then assigns a polynomial parameter (C)₀,C₁,…,C_t-1) Disclosed within a group;

(3.6) group Member A based on the received parameter (C)₀,C₁,…,C_t-1) And a omega time point W of a base point G on the disclosed elliptic curve, and calculating a group sharing symmetric key theta, which is realized as follows:

(3.6a) group member A firstly uses omega times point W of base point G on the elliptic curve disclosed by group manager and its private key SK_ACalculating its own pseudonym x_A′＝H(ID_A||WSK_A)；

(3.6b) group member a calculates the group-shared symmetric key θ by the following formula:

where t is the total number of members in the group, x_iIs a pseudonym of the ith group member, (C)₀,…,C₁,C_t-1) Is a parameter of a polynomial.

And 4, carrying out group signature on the group members.

(4.1) after recording the current time stamp T epsilon {0,1} of the group member A^*Then, the temporary private key SK of the group member A is calculated_A,T＝H(SK_A| T), then calculates group member a temporary public key PK_A,T＝SK_A,TG, where, SK_AIs the private key of the group member A, and H () is a secure hash function, wherein G is the base point of the elliptic curve;

(4.2) group Member A sends symmetric ciphertext E_θ(ID_A,PK_A,TT) to a group administrator GM, where E_θ() A symmetric encryption algorithm;

(4.3) group Administrator GM interfaceReceive ciphertext E_θ(ID_A,PK_A,TT) and then using the key theta to decrypt, and if the decryption is successful and the timestamp T is valid, the identity Information (ID) of the member a can be obtained_A,PK_A,TT), executing the step (4.4), otherwise, terminating the signature;

(4.4) group Member A generates a random number k e [1, n-1 ∈]Where n is the order of the base point G, and calculating the point β on the elliptic curve as (x)₁,y₁)＝[k]G, wherein x₁,y₁The horizontal and vertical coordinates of the calculated point are obtained;

(4.5) calculating the group signature identification by the group member A through a probability algorithm, wherein the method is realized as follows:

(4.5a) the group member A computes a hash function on the temporary public key PK using the following formula_A,TAnd a group public key PK_GMHash value c of (a):

c＝H(PK_A,T||PK_GM||E_A) <7>

where H () is a secure hash function, PK_A,TTemporary public key, PK, for group member A_GMIs a group public key, E_AIs the intermediate quantity of the signature;

(4.5b) group Member A first considers two parameters a and b of the elliptic curve equation, and the abscissa x and the ordinate of the base point G on the elliptic curve_G、y_GAnd the public key PK A of the group members_AAbscissa and ordinate x of_A、y_AConverting the data type into bit string, and calculating the hash value Z of the hash function acting on the identity information of the group member A by using the following formula_A：

Z_A＝H₂₅₆(ENTL_A||ID_A||a||b||x_G||y_G||x_A||y_A) <8>

Wherein, ID_ABeing the true identity of group member A, ENTL_AIs ID_AA length value of (d);

(4.5c) group member A computes the hash value of the message M to be signed: e ═ H_v(Z_A| M), wherein H_v() V is the message digest length, a cryptographic hash function;

(4.5d) calculation of the abscissa x of the elliptic Curve Point by the group Member A₁The remainder value found: r ═ e + x₁) mod n, where x₁Is an elliptic curve point (x)₁,y₁) Mod n represents a modulo operation of an integer divided by n;

(4.5e) group Member A selects three random numbers

And sequentially calculating a first random number r by the following formula₁Blind value s of₁A second random number r₂Blind value s of₂A third random number r₃And a temporary private key SK_A,TBlind value s of₃：

s₁＝r₁-ce，

s₂＝r₂-ce， <9>

s₃＝r₃-cSK_A,Tk^-1，

Where k is the point (x) of the group member A on the computed elliptic curve₁,y₁) Random number of time selection, SK_A,TA temporary private key that is a group member a;

(4.5f) the group Member A calculates the Member temporary private Key SK using the formula_A,TIntermediate quantity E to signature_AIs encrypted value T_A,T：

T_A,T＝E_A+SK_A,TPK_GM <10>

(4.5g) group member A calculates group public key PK from integer point beta on the elliptic curve_GMFor three random numbers r₁,r₂,r₃The blinding value of(s) ═ r₁T_A,T-r₂GPK_GM+r₁β-r₂G+r₃β；

(4.6) outputting the group signature identification as (c, s)₁,s₂,s₃,T_A,T,PK_A,T,r,s)。

And 5, verifying the group signature identification.

(5.1) the verifier D firstly verifies whether r belongs to [1, n-1], s belongs to [1, n-1], if yes, the step (5.2) is executed, otherwise, the group signature identification is illegal, and the step 6 is executed;

(5.2) the verifier D calculates the hash value e 'and the verification intermediate quantity t' of the message M to be signed in sequence according to the following formula:

t′＝c(PK_GM+GPK_A,T)+s₁T_A,T-s₂GPK_GM-s₂G+cPK_A,T <11>

e′＝H_v(Z_A||M) <12>

wherein c is a hash function acting on the temporary public key PK_A,TAnd a group public key PK_GMOf a hash value, PK_GMIs a group public key, G is a base point of an elliptic curve, PK_A,TTemporary private key, s, being a group member A₁Is a first random number r₁Blind value of s₂Is a second random number r₂Blind value of, PK_GMIs a group public key, H_v() For cryptographic hash functions, v is the message digest length, Z_AIs a hash value of the group member a.

(5.3) calculating elliptic Curve Point (x'₁,y′₁)＝(s₁+s₃)^-1(s-t '), and a proof value of R ═ e ' + x '₁) mod n, where x'₁,y′₁Mod n represents a modulo operation of dividing an integer by n for the abscissa and ordinate of the elliptic curve point;

and (5.4) verifying whether the R is true or not by the verifier D, if so, judging that the group signature identifier is legal, ending the group signature process, otherwise, judging that the group signature identifier is illegal, and executing the step 6.

And 6, opening the group signature identification.

(6.1) group Administrator GM uses the group private Key SK_GMAnd the temporary public key PK of the group member A_A,TCalculating the public key PK of the signer_AIt is implemented as follows:

(6.1a) the group Administrator GM calculates the intermediate quantity E of the group signature of the tracking procedure by the following formula_A′:

E_A′＝T_A,T-PK_A,TSK_GM， <13>

Wherein, T_A,TSK is private key of member_A,TIntermediate quantity E to signature_AEncrypted value of, PK_A,TIs a temporary public key of the signer, SK_GMIs a group private key;

(6.1b) group Administrator GM computes public Key PK of group Member A_A＝γE_A′-SK_GMWherein gamma is a medium random number of the group signature selected by the group administrator GM;

(6.2) the group administrator GM further passes the group membership Information (ID) stored in the membership information list_A,PK_A) Group member true identity ID with tracked to signature_AExecuting (7);

and 7, revoking the group members.

(7.1) the group administrator GM selects a new group-shared symmetric key

A new polynomial f (x)' is generated, expressed as follows:

where t is the total number of members in the group, x_iIs the pseudonym of the ith group member, theta' is the newly generated group shared symmetric key, (C)₀′,C₁′,…C_t-1') are parameters of the newly generated polynomial.

(7.2) the group Administrator GM computes the group Member real identity ID in addition to the signature traced_APseudonyms x of the remaining t-1 group members outside_iAnd new polynomial parameters (C)₀′,C₁′,…C_t-1') public so that the identity is tracked as an ID_AThe group member of (1) will not be able to compute a new group-shared symmetric key from the parameter and therefore not be able to sign, at which point the group member is revoked.

The foregoing description is only an example of the present invention and is not intended to limit the invention, so that it will be apparent to those skilled in the art that various changes and modifications in form and detail may be made therein without departing from the spirit and scope of the invention.

Claims

1. A group signature label issuing method based on SM2 digital signature algorithm is characterized by comprising the following steps:

(1) initializing parameters:

let F_qIs a finite field of order q; selecting an elliptic curve equation E as y²＝x³+ ax + b, where a, b ∈ F_q(ii) a Is provided with a limited area F_qThe set of all rational points of the upper elliptic curve equation E is E (F)_q) (ii) a Let base point G with order n on E be (x)_G，y_G) Wherein x is_G，y_GAs coordinates of a base point; cipher hash algorithm H with selected message length of v bits_v() (ii) a Selecting a secure hash function H: {0,1} → Z_GWherein Z is_GSelecting a symmetric encryption algorithm E (), which is an integer value of a base point G;

(2) random selection of key generation center KGC

As a group private key, wherein

(3) Group member a joined the group:

(3.1) group Administrator GM generates a public and private key pair (SK) for group Member A_A，PK_A) And sent to group member a over a secure channel, the group member a communicating the identity and public key Information (ID)_A，PK_A) Sent to the group Administrator GM through a secure channel, wherein the ID_AFor group member A true identity, PK_ABeing the public key of group member A, SK_AA private key that is a group member a; the group administrator GM associates the identity Information (ID) of the group member A_A，PK_A) Storing the information into a group member information list and countingComputing group signature intermediate quantity E_AAnd then E is transmitted through a secure channel_ASending the information to a group member A; group administrator GM calculates the intermediate quantity E of group signatures_AThe group administrator GM selects the intermediate random number of the group signature

Calculating the group signature intermediate quantity E by using the following formula_A：

E_A＝(SK_GM+PK_A)·γ^-1，

Wherein SK_GMIs a group public key, PK_AIs the public key of group member A;

(3.2) group Administrator GM first selects a polynomial

Where t is the total number of group members, x_iIs the pseudonym of the ith group member, theta is the group shared symmetric key, (C)₀，C₁，…，C_t-1) A parameter that is a polynomial; then, the omega multiple point W of base point G on the elliptic curve is calculated as omega G, and the pseudonym x of group member A_AAnd the W point and the polynomial parameter are disclosed in the group; the group administrator GM first selects a random number

Then, the pseudonym x of the group member A is calculated by using the following formula_A：

x_A＝H(ID_A||ωPK_A)

(3.3) group Member A based on the received parameter (C)₀，C₁，…，C_t-1) Calculating a group sharing symmetric key theta; the implementation is as follows:

(3.3a) group Member A first bases on the ellipse published by the group administratorOmega multiple point W of base point G on curve and private key SK of base point G_ACalculating its own pseudonym x_A′＝H(ID_A||WSK_A)；

(3.3b) the group member a calculates the group-shared symmetric key θ by the following formula:

where t is the total number of members in the group, x_iIs a pseudonym of the ith group member, (C)₀，…，C₁，C_t-1) A parameter that is a polynomial;

(4) the group member a signs the message M:

(4.1) group Member A sends symmetric ciphertext E_θ(ID_A，PK_A，TT) group administrator GM, where PK_A，TIs a temporary public key of group member A, T is a time stamp of the current time, E_θ() A symmetric encryption algorithm;

(4.2) group Administrator GM receives ciphertext E_θ(ID_A，PK_A，TAnd T) then using the secret key theta to decrypt, and if the decryption is successful and the time stamp T is valid, the identity Information (ID) of the member A can be obtained_A，PK_A，TAnd T), executing the step (4.3), otherwise, terminating the signature;

(4.3) group Member A generates a random number k e [1, n-1 ∈]Where n is the order of the base point G, and calculating the point β on the elliptic curve as (x)₁，y₁)＝[k]G, wherein x₁，y₁The horizontal and vertical coordinates of the calculated point are obtained;

(4.4) group Member A selects three random numbers

And using the message M to be signed, the group public key PK_GMAnd the temporary private key SK of the group member A_A，TOutputting the group signature identifier as (c, s) through a probability algorithm₁，s₂，s₃，T_A，T，PK_A，TR, s), where c is the hash function applied to the neighborTime public key PK_A，TAnd a group public key PK_GMOf the hash value s₁Is a first random number r₁Blind value of s₂Is a second random number r₂Blind value of s₃Is a third random number r₃And a temporary private key SK_A，TBlind value of, T_A，TSK is private key of member_A，TIntermediate quantity E to signature_AR is the abscissa x of the point of the elliptic curve₁The obtained remainder value s is the group public key PK_GMFor random number r₁，r₂，r₃(ii) a blinded value of;

the hash function is computed to act on the temporary public key PK using the following formula_A，TAnd a group public key PK_GMHash value c of (a):

c＝H(PK_A，T||PK_GM||E_A)

where H () is a secure hash function, PK_A，TTemporary public key, PK, for group member A_GMIs a group public key, E_AIs the intermediate quantity of the signature;

(5) identifying (c, s) the group signature₁，s₂，s₃，T_A，T，PK_A，TR, s) verify:

(5.1) firstly checking whether r belongs to [1, n-1], s belongs to [1, n-1] or not by a verifier D, if yes, executing (5.2), otherwise, executing the step (6) if the group signature is illegal;

(5.2) the verifier D calculates the hash value e ' and the verification intermediate quantity t ' of the message M to be signed in turn, and calculates the elliptic curve point (x '₁，y′₁)＝(s₁+s₃)^-1(s-t '), and a proof value of R ═ e ' + x '₁) mod n, where x'₁，y′₁Mod n represents a modulo operation of dividing an integer by n for the abscissa and ordinate of the elliptic curve point; the hash value e 'and the intermediate signature checking quantity t' are carried out according to the following formula:

t′＝c(PK_GM+GPK_A，T)+s₁T_A，T-s₂GPK_GM-s₂G+cPK_A，T，

e′＝H_v(Z_A||M)，

wherein c is a hash function acting on the temporary public key PK_A，TAnd a group public key PK_GMOf a hash value, PK_GMIs a group public key, G is a base point of an elliptic curve, PK_A，TTemporary private key, s, being a group member A₁Is a first random number r₁Blind value of s₂Is a second random number r₂Blind value of, PK_GMIs a group public key, H_v() For cryptographic hash functions, v is the message digest length, Z_AIs a hash value of group member a;

(5.3) the verifier D verifies whether the R is true, if so, the group signature is legal, the group signature process is ended, otherwise, the group signature is illegal, and (6) is executed;

(6) the group administrator GM extracts the member private key SK from the group signature_A，TIntermediate quantity E to signature_AIs encrypted value T_A，TUsing the group private key SK_GMAnd the temporary public key PK of the group member A_A，TCalculating the public key PK of the signer_AAnd then through group membership Information (ID) stored in a membership information list_A，PK_A) Group member true identity ID with tracked to signature_AExecuting (7);

(7) the group master GM selects a new group-shared symmetric key

Generating a new polynomial f (x)', calculating the real identity ID of the group member except the tracked signature_APseudonyms x of the remaining t-1 group members outside_iAnd new polynomial parameters (C)₀′，C₁′，…C_t-1') public so that the identity is tracked as an ID_AThe group member of (1) will not be able to compute a new group-shared symmetric key from the parameter and therefore not be able to sign, at which point the group member is revoked.

2. The method according to claim 1, wherein said (3.1) key generation center KGC generates a public-private key pair (SK) for group member a_A，PK_A) Is selected by the group administrator GMRandom number

As the private key of the group member A and calculates the public key PK of the group member A_A＝SK_AG, wherein G is the base point of the elliptic curve.

3. The method according to claim 1, wherein the temporary public key PK in (4.1)_A，TThe current time stamp T epsilon {0,1} is recorded by the group member A^*Then, the temporary private key SK of the group member A is calculated_A，T＝H(SK_A| T), then calculates group member a temporary public key PK_A，T＝SK_A，TG, where, SK_AIs the private key of group member a, H () is the secure hash function, where G is the base point of the elliptic curve.

4. The method according to claim 1, wherein the (4.4) outputs the group signature as (c, s) through a probabilistic algorithm₁，s₂，s₃，T_A，T，PK_A，TR, s), which is implemented as follows:

(4.4b) group Member A first considers two parameters a and b of the elliptic curve equation, and the abscissa x and the ordinate of the base point G on the elliptic curve_G、y_GAnd group member A public key PK_AAbscissa and ordinate x of_A、y_AConverting the data type into bit string, and calculating the hash value Z of the hash function acting on the identity information of the group member A by using the following formula_A：

Z_A＝H₂₅₆(ENTL_A||ID_A||a||b||x_G||y_G||x_A||y_A)，

(4.4c) group member A computes the hash value e ═ H of the message M to be signed_v(Z_A| M), wherein H_v() V is the message digest length, a cryptographic hash function;

(4.4d) group Member ACalculating the abscissa x of the point of the elliptic curve₁Found remainder value r: r ═ e + x₁) mod n, where x₁Is an elliptic curve point (x)₁，y₁) Mod n represents a modulo operation of an integer divided by n;

(4.4e) group Member A calculates a first random number r₁Blind value s of₁：s₁＝r₁-ce；

(4.4f) group Member A calculates a second random number r₂Blind value s of₂：s₂＝r₂-ce；

(4.4g) calculation of the third random number r by the group Member A₃And a temporary private key SK_A，TBlind value s of₃：s₃＝r₃-cSK_A，Tk^-1Where k is the point (x) of the group member A on the computed elliptic curve₁，y₁) A random number selected;

(4.4h) the group Member A calculates the Member temporary private Key SK using the following formula_A，TIntermediate quantity E to signature_AIs encrypted value T_A，T：

T_A，T＝E_A+SK_A，TPK_GM

(4.4i) group Member A points (x) on the elliptic curve₁，y₁) Converting to integer point beta, calculating group public key PK_GMFor random number r₁，r₂，r₃The blinding value of(s) ═ r₁T_A，T-r₂GPK_GM+r₁β-r₂G+r₃β。

5. The method according to claim 1, wherein the (6) uses a group private key SK_GMAnd the temporary public key PK of the group member A_A，TCalculating the public key PK of the signer_AIt is implemented as follows:

(6a) the group master GM calculates the intermediate quantity E of group signatures for the tracking process by the following formula_A′：

E_A′＝T_A，T-PK_A，TSK_GM，

Wherein, T_A，TSK is private key of member_A，TIntermediate quantity E to signature_AEncrypted value of, PK_A，TIs a temporary public key of the signer, SK_GMIs a group private key;

(6b) group administrator GM compute PK_A＝γE_A′-SK_GMWhere γ is the median random number of the group signature selected by the group administrator GM.

6. The method according to claim 1, characterized in that said (7) group administrator GM selects a new group-shared symmetric key θ 'to generate a new polynomial f (x)' expressed as follows:

where t is the total number of members in the group, x_iIs the pseudonym of the ith group member, theta' is the newly generated group shared symmetric key, (C)₀′，C₁′，…C_t-1') are parameters of the newly generated polynomial.