CN113014399B - Pairing operation method and system for resource-limited device - Google Patents

Abstract

The pairing operation method for the resource-limited device comprises the following steps: the first party is a resource-constrained device, and the first party is a non-resource-constrained device; there is a bilinear map e: g₁×G₂→G_TThe order is a prime number n; the first party has a secret c, k, Q ═ ck]P₂+[c]P_pub2(ii) a When the first party needs to calculate u ═ e (S, P), where P ═ h₁]P₂+P_pub2，h₁Is an integer, P_pub2＝[s₂]P₂Giving Q to the second party; second party calculates g₁＝e(S,P₂)，g₂E (S, Q); first party utilizes g₁、g₂Obtaining a value of u ═ e (S, P); alternatively, the first party has a secret c, has a group G₁Meta of (1)_z，g_z1＝e(P_z,P₂)^‑1，g_z2＝e(P_z,P_pub)^‑1(ii) a When the first party needs to calculate u-e (S, P), S is calculated₁＝[c](S+P_z) (ii) a Second calculation of P ═ h₁]P₂+P_pub2，u₁＝e(S₁P), the first party utilizes g_z1、g_z2、u₁The value of u ═ e (S, P) was obtained.

Description

Pairing operation method and system for resource-limited device

Technical Field

The invention belongs to the technical field of passwords, and particularly relates to a pairing operation method and a pairing operation system for SM9 signature verification for a resource-limited device.

Background

Compared with the pki (public Key infrastructure) adopting the digital certificate technology, the Identity Based Cryptography (IBC) saves the troublesome link of acquiring the public Key digital certificate of the private Key owner, has simple technical implementation, is increasingly emphasized by people at present, and has wide application prospects.

The identification-Based password can be used for data Encryption (called Identity Based Encryption, IBE) and digital Signature (called Identity Based Signature, IBS). At present, most of cryptographic algorithms based on identification adopt algorithms based on bilinear mapping (also called Pairing operation, Pairing operation), wherein the bilinear mapping (Pairing operation) is as follows:

e：G₁×G₂→G_Tin which G is₁、G₂(groups of pairwise or bilinear mappings) are additive cyclic groups, G_TIs a multiplication loop group, G₁、G₂、G_TIs a prime number n (G is used in the SM9 specification)₁、G₂、G_TThe order of (A) is capital letter N), i.e., if P, Q, R are G respectively₁、G₂In (b), e (P, Q) is G_TAnd:

e(P+R,Q)＝e(P,Q)e(R,Q)，

e(P,Q+R)＝e(P,Q)e(P,R)，

e([a]P,[b]Q)＝e(P,Q)^ab。

where a and b are integers of [0, n-1], and [ a ] P and [ b ] Q represent multiple times of point P, Q.

SM9 is an identification cryptographic algorithm based on bilinear mapping (pairing operation) issued by the national crypto authority. The SM 9-based cryptographic algorithm can realize digital signature based on identification, key exchange and data encryption. In the SM9 cryptographic algorithm, the SM9 identity private key d used by the user for signing is used_AThe process of generating a digital signature for message M is as follows:

calculating to obtain w ═ g^rWhere r is the value at 1, n-1 in signature computation]Randomly selected integer in the interval, g ═ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is the master private or master key, P₂Is G₂See SM9 specification; note that here the master private or master key, the master public key, the user's SM9 for signature identifies the sign of the private key as opposed to that in the SM9 specification);

then, H is calculated as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_T(iii) order (see SM9 specification, note that the order of the group here uses symbols slightly different from the SM9 specification, using the lower case letter N, while the SM9 specification uses the upper case letter N);

if r ≠ h, calculate S [ [ r-h ≠ h]d_AThen (h, S) is the generated digital signature; and if r is equal to h, reselecting r, and recalculating w and h until r is not equal to h.

Given the digital signature (h, S) of a message M, the method of verifying the validity of the signature is as follows (see the SM9 specification, note that the signature verification procedure in the SM9 specification uses the notation M ', (h ', S ')).

B1: checking whether h is formed by the element [1, n-1], if not, verifying that the h is not passed;

b2: checking that S belongs to G₁If the verification result is not true, the verification is not passed;

b3: computing group G_TWherein the element g ═ e (P)₁,P_pub)；

B4: computing group G_TChinese YuanG or t^h；

B5: calculating the integer h₁＝H₁(ID_A| hid, n) (here ID_AThe identity of the user, hid, is the signature private key generating function identifier expressed in one byte, H₁() Is a hash or hash function defined in the SM9 specification);

b6: computing group G₂Wherein the element P ═ h₁]P₂+P_pub；

B7: computing group G_TThe element in (1) is (e) (S, P);

b8: computing group G_TWherein w' is u.t;

b9: calculating the integer h₂＝H₂(M | | w', n), test h₂If h is true, the verification is passed; otherwise, the verification fails (H)₂() Is a hash or hash function defined in the SM9 specification).

In the signature verification process, pairing operation u-e (S, P) is required, the pairing operation is complex, and a computing device with sufficient computing power and computing resources is required to complete the pairing operation within an acceptable time, and for some resource-limited devices, such as wireless sensors, various small computing devices in the internet of things, such as smart meters and field controllers, it is difficult to have sufficient computing power and computing resources to complete or complete the complex pairing operation within an acceptable time.

Disclosure of Invention

The invention aims to provide a corresponding solution for the problem of insufficient computing power of pairing operation of a resource-limited device.

In order to achieve the above object, the technical solution of the present invention includes a pairing operation method and system for a resource-limited device.

The technical scheme of the invention relates to bilinear mapping (pairing operation) e: g₁×G₂→G_T(ii) a Group G₁、G₂As additive groups (usually groups of elliptic curve points), group G_TAs a multiplicative group (typically an integer multiplicative group); group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is the group G₁In (1), T is a group G₂The element of (1);

e₂(V, T) ═ e (T, V), where V is group G₂In (1), T is a group G₁The element of (1).

The technical solution of the present invention is described below, in which, unless otherwise specified, a^-1The inverse of modulo n multiplication by a (i.e., (a)^-1a)mod n＝1)。

The pairing operation method for the resource-limited device of the invention relates to two parties: a first party, which is a resource-constrained device, and a second party, which is a non-resource-constrained device (a device with sufficient computing power, computing resources).

The pairing operation method for the resource-limited device further comprises five schemes, which are specifically as follows.

Scheme I,

The first side has [1, n-1]]Inner (randomly selected) integer secret c, k (constant) is calculated (in advance or in real time) with Q ═ ck]P_j+[c]P_pubjOr Q ═ k]P_j+[c]P_pubjWherein [ 2 ], []Represents a pair group G₁And G₂Multiple point addition (multiplication) of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jA master key (master private key);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCooperative calculation of (S, P):

the first party sends S, Q to the second party;

second party calculates g₁＝e_i(S,P_j)，g₂＝e_i(S, Q), then g₁、g₂Sending to the first party;

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value of (S, P);

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value modes of (S, P) include:

if Q is calculated as Q ═ ck]P_j+[c]P_pubjThen, calculate t ═ h₁-k)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ c (h)₁-k))mod n，u＝((g₁^t)g₂)^c^-1；

If Q is calculated as Q ═ k]P_j+[c]P_pubjThen, calculate t ═ h₁-c^-1k)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ (ch)₁-k)mod n，u＝((g₁^t)g₂)^c^-1；

In the above calculation, ^ represents the power operation (the number of power operations on the element before ^ and the number of power operations after ^ c), c^-1The modulo n multiplication inverse of c (i.e., (cc)^-1)mod n＝1)。

Scheme II,

The first side has [1, n-1]]Inner (randomly selected) integer secrets b, c, k (constants) are calculated (in advance or in real time) with Q₁＝[b]P_j，Q₂＝[ck]P_j+[c]P_pubjOr Q₂＝[k]P_j+[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition (multiplication) of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jA master key (master private key); b and c do not have to be different;

(Note: b is not secret, this scheme is still true, if b is not secret, then scheme two is identical to scheme one)

When the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first party S, Q₁、Q₂Sending to the second party;

second party calculates g₁＝e_i(S,Q₁)，g₂＝e_i(S,Q₂) Then g is added₁、g₂Sending to the first party;

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value of (S, P);

first party utilizes g₁、g₂Calculating to obtain u-e_iThe manner of the value of (S, P) includes:

if Q₂Is calculated as Q₂＝[ck]P_j+[c]P_pubjThen, t ═ h is calculated₁-k)b^-1)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ c (h)₁-k)b^-1)mod n，u＝((g₁^t)g₂)^c^-1；

If Q₂Is calculated as Q₂＝[k]P_j+[c]P_pubjThen, t ═ h is calculated₁-c^-1k)b^-1)mod n，u＝(g₁^t)(g₂^c^-1) Alternatively, t ═ is calculated ((ch)₁-k)b^-1)mod n，u＝((g₁^t)g₂)^c^-1；

In the above calculation, ^ represents an exponentiation, b^-1Is the inverse of the modulo n multiplication of b, c^-1The modulo n multiplication inverse of c.

Scheme III,

The first side has [1, n-1]]Inner (randomly selected) integer secret c (constant) is calculated (in advance or in real time) with Q₁＝[c]P_j，Q₂＝[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition (multiplication) of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jA master key (master private key);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first, calculate Q ═ h₁]Q₁+Q₂S, Q to the second party;

second party calculates u₁＝e_i(S, Q), adding u₁Occurs to the first party;

first calculate u ═ u₁^(c^-1) Wherein ^ represents power operation, c^-1Is the modulo n multiplication inverse of c.

For the third scheme above, the first party needs to calculate [ h ] in real time₁]Q₁This may be difficult for some resource-constrained devices, for which the first party is prevented from calculating h in real time₁]Q₁A pairing operation e_iThe (S, P) collaborative calculation scheme is as follows.

Scheme IV,

The first party has [1, n-1]]Inner (randomly selected) integer secret c, k (constant) is calculated (in advance or in real time) with Q₁＝[c]P_j，Q_k＝[ck]P_j+[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition (multiplication) of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs group G_jMaster public key in (1), s_jTo group G_jA master key (master private key);

at each pairing operation e_iBefore (S, P), the first party calculates Q_r＝[r]Q₁Wherein r is [1, n-1]]Internal and external secret integers, and for each pairing operation e_i(S, P), r is different (how to select r and calculate Q)_rThings outside of the present invention);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first, calculate b ═ r^-1(h₁-k)) mod n, where r^-1Is the modulo n multiplication inverse of r;

the first party is to convert S, b, Q_r、Q_kSending to the second party;

second party calculates u₁＝e_i(S,[b]Q_r+Q_k) Will u₁Occurs to the first party;

first calculate u ═ u₁^(c^-1) Wherein ^ represents power operation, c^-1Is the modulo n multiplication inverse of c.

For the above pairing operation method, if h₁＝H₁(ID_AI hid, n), the above method can be used for the calculation of u-e (S, P) in the verification of the SM9 digital signature (h, S) of the message M (when j is 2, i is 1, if the decryption private key of SM9 is used for the signature, the corresponding j is 1, i is 2).

Using the above aspects of the pairing algorithm for verification of the SM9 digital signature (h, S) for the message M, if a multiplicative modification of S in the digital signature (h, S) occurs, i.e. multiplying S by an integer p, and the second party knows this modification and cheats, then the first party is unable to find this modification (i.e. the signature verification still passes), although if the original (h, S) is a digital signature of the message M and the message M is not altered, then this cheating of the second party does not change the property that the modified (h, S) still has as a valid signature of the message M, i.e. it can be proved that the message M is unmodified and that the (original) S was generated by the identity private key.

The following is a scheme in which the digital signature (h, S) verification cannot pass once S is modified.

Scheme five,

The first party has a group G_iSelected foreign security element P_zI-1 or 2, g is calculated (in advance or in real time)_z1＝e_i(P_z,P_j)^-1，g_z2＝e_i(P_z,P_pubj)^-1Wherein j is 3-i, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jA master key (master private key);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iIn the formula (II), P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCooperative calculation of (S, P):

first party calculates S₁＝[c](S+P_z) Or S₁＝[c]S+P_z，g_z＝(g_z1^h₁)g_z2Wherein c is a first party in [ n-1]]Inner (randomly selected) integer secret (constant), or calculate S₁When the first party is [1, n-1]]An internal randomly selected integer, wherein ^ represents power operation;

first party h₁、S₁Sending to the second party;

second party calculation P ═ h₁]P_j+P_pubj，u₁＝e_i(S₁P), then u is added₁Sending to the first party;

first party utilizes u₁Calculated u-e_i(S, P) value;

first party utilizes u₁Calculated u-e_iThe manner of (S, P) values includes:

if calculating S₁Using the formula S₁＝[c](S+P_z) Then, calculate u ═ u (u)₁^c^-1)g_z；

If calculating S₁Using the formula S₁＝[c]S+P_zThen, calculate u ═ u (u)₁g_z)^c^-1；

In the above calculation, c^-1The modulo-n multiplication inverse of c;

above-mentioned G_iSelected foreign security element P_zIs an initialization at group G_iSelecting randomly the elements; from G_iIn the selection of one randomlyIndividual element P_zThe method comprises the following steps: in [1, n-1]]Randomly selecting an integer z, and calculating P_z＝[z]P_i，g_z1＝e_i(P_i,P_j)^-z，g_z2＝e_i(P_i,P_pubj)^-z(i.e., g)_z1＝e_i(P_i,P_j)^(-z)，g_z2＝e_i(P_i,P_pubj)^(-z))。

For any of the above schemes one to five, if the verification fails in practical application for signature verification, and it needs to be determined whether the verification failure is caused by the second party being untrusted and unreliable or the digital signature being invalid, then u-e may be calculated by using other schemes_i(S, P), the other schemes comprise a different scheme in the four schemes, or e except the four schemes_i(S, P) computing the solution (whether interacting with the second party is not necessary); and if the u calculated by adopting other schemes is different from the u calculated before, determining that the second party is not credible or unreliable, otherwise, determining that the signature verification fails due to invalid digital signature.

On the basis of the pairing operation method (any one scheme) for the resource-limited device, a pairing operation system for the resource-limited device can be constructed, wherein the system comprises the resource-limited device and a non-resource-limited device, the resource-limited device serves as the first party, and the non-resource-limited device serves as the second party;

when a resource-constrained device (in verifying the digital signature (h, S) of the message M) needs to compute u-e_i(S, P) wherein i is 1 or 2, and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]An internal integer, j-3-i, where u-e is obtained by the resource-restricted device and the non-resource-restricted device through cooperative calculation according to the pairing operation method for the resource-restricted device_i(S, P) value.

Based on the present invention, the first party as a resource-constrained device does not need to perform pairing operations in real time, and for solutions one and two, the first party as a resource-constrained device does not even need to perform operations on elements in elliptic curve point groups in real time, and for solution four, the first party as a resource-constrained device can also avoid performing operations on multiplication of numbers of elements in elliptic curve point groups in real time (point addition operations are also available) with the aid of the second party as a non-resource-constrained device. The present invention results from the verification of SM9 digital signatures, but the invention is not limited to use for the verification of SM9 digital signatures.

Detailed Description

The following describes specific implementations of the present invention.

Examples 1,

This embodiment involves bilinear mapping (pairing operation) e: g₁×G₂→G_T(ii) a Group G₁、G₂As additive groups (usually groups of elliptic curve points), group G_TAs a multiplicative group (typically an integer multiplicative group); group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

This embodiment involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device (a device with sufficient computing power, computing resources);

when the first party of this embodiment needs to compute the pairing operation u-e (S, P), where S is the group G₁Wherein, P ═ h₁]P₂+P_pub2，h₁Is [1, n-1]]Internal integer, P_pub2＝[s₂]P₂Is a group G₂Master public key in (1), s₂To a group G₂The first party and the second party complete the pairing operation of u-e (S, P) in the case where i is 1 and j is 2 in the first scheme of the pairing operation method for the resource-restricted device.

Examples 2,

The difference between this embodiment and embodiment 1 is that when the first party of this embodiment needs to calculate the pairing operation u-e (P, S), where S is the group G₂Wherein, P ═ h₁]P₁+P_pub1，h₁Is [1, n-1]]The number of the internal integers is equal to or greater than the total number of the internal integers,P_pub1＝[s₁]P₁is a group G₁Master public key in (1), s₁To a group G₁The first party and the second party complete the pairing operation of u-e (P, S) in the case where i is 2 and j is 1 in the first scheme of the pairing operation method for the resource-restricted device.

Examples 3,

The difference between this embodiment and embodiment 1 is that when the first party needs to compute the pairing operation u-e (S, P), where S is the group G₁Wherein, P ═ h₁]P₂+P_pub2，h₁Is [1, n-1]]Internal integer, P_pub2＝[s₂]P₂Is a group G₂Master public key in (1), s₂To a group G₂The first party and the second party complete the pairing operation of u-e (S, P) in the case where i is 1 and j is 2 in the second scheme of the pairing operation method for the resource-restricted device.

Examples 4,

The difference between this embodiment and embodiment 2 is that when the first party of this embodiment needs to calculate the pairing operation u-e (P, S), where S is the group G₂Wherein, P ═ h₁]P₁+P_pub1，h₁Is [1, n-1]]Internal integer, P_pub1＝[s₁]P₁Is a group G₁Master public key in (1), s₁To a group G₁The first party and the second party complete the pairing operation of u-e (P, S) in the case where i is 2 and j is 1 in the second scheme of the pairing operation method for the resource-restricted device.

Examples 5,

The difference between this embodiment and embodiment 1 is that when the first party needs to compute the pairing operation u-e (S, P), where S is the group G₁Wherein, P ═ h₁]P₂+P_pub2，h₁Is [1, n-1]]Internal integer, P_pub2＝[s₂]P₂Is a group G₂Master public key in (1), s₂To a group G₂The first party and the second party are the parties of the aforementioned pairing operation method for the resource-constrained deviceIn the case where i is 1 and j is 2, the pairing operation of u-e (S, P) is completed.

Examples 6,

The difference between this embodiment and embodiment 2 is that when the first party of this embodiment needs to calculate the pairing operation u-e (P, S), where S is the group G₂Wherein, P ═ h₁]P₁+P_pub1，h₁Is [1, n-1]]Internal integer, P_pub1＝[s₁]P₁Is a group G₁Master public key in (1), s₁To a group G₁The first party and the second party complete the pairing operation of u-e (P, S) in the case where i is 2 and j is 1 in the third scheme of the pairing operation method for the resource-restricted device.

Example 7,

The difference between this embodiment and embodiment 1 is that when the first party needs to compute the pairing operation u-e (S, P), where S is the group G₁Wherein, P ═ h₁]P₂+P_pub2，h₁Is [1, n-1]]Internal integer, P_pub2＝[s₂]P₂Is a group G₂Master public key in (1), s₂To a group G₂The first party and the second party complete the pairing operation of u-e (S, P) in the case where i is 1 and j is 2 in the above-mentioned scheme four of the pairing operation method for the resource-restricted device.

Example 8,

The difference between this embodiment and embodiment 2 is that when the first party of this embodiment needs to calculate the pairing operation u-e (P, S), where S is the group G₂Wherein, P ═ h₁]P₁+P_pub1，h₁Is [1, n-1]]Internal integer, P_pub1＝[s₁]P₁Is a group G₁Master public key in (1), s₁To group G₁The first party and the second party complete the pairing operation of u-e (P, S) in the case where i is 2 and j is 1 in the above-mentioned scheme four of the pairing operation method for the resource-restricted device.

Examples 9,

The difference between this embodiment and embodiment 1 is that when the first party requires itWhen the pairing operation u-e (S, P) is calculated, where S is the group G₁In the formula (II), P ═ h₁]P₂+P_pub2，h₁Is [1, n-1]]Internal integer, P_pub2＝[s₂]P₂Is a group G₂Master public key in (1), s₂To a group G₂The first party and the second party complete the pairing operation of u-e (S, P) in the case where i is 1 and j is 2 in the fifth scheme of the pairing operation method for the resource-restricted device.

Examples 10,

The difference between this embodiment and embodiment 2 is that when the first party of this embodiment needs to calculate the pairing operation u ═ e (P, S), where S is the group G₂Wherein, P ═ h₁]P₁+P_pub1，h₁Is [1, n-1]]Internal integer, P_pub1＝[s₁]P₁Is a group G₁Master public key in (1), s₁To a group G₁The first party and the second party complete the pairing operation of u-e (P, S) in the case where i is 2 and j is 1 in the fifth scheme of the pairing operation method for the resource-restricted device.

The above embodiments 1, 3, 5, 7, 9 can be used for e (S, P) calculation in the signature verification process of SM9 digital signature (h, S), when h is₁＝H₁(ID_A| hid, n); if the encryption private key in SM9 is of course used as the signature private key, e (P, S) is calculated in the signature verification process of the digital signature (h, S) in the above embodiments 2, 4, 6, 8, 10, and h is calculated in this case₁＝H₁(ID_A| hid, n); the invention and its implementation are not limited to the SM9 cryptographic algorithm.

The resource-restricted device as the first party and the non-resource-restricted device as the second party in the above embodiments constitute a collaborative computing system for performing pairing operations e (S, P) or e (P, S) for the resource-restricted device.

Other specific technical implementations not described are well known to those skilled in the relevant art and will be apparent to those skilled in the relevant art.

Claims (10)

1. A pairing operation method for a resource-limited device is characterized by comprising the following steps:

the method involves a bilinear map e: g₁×G₂→G_T(ii) a Group G₁、G₂To add the group, group G_TIs a multiplicative group; group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is the group G₁In (1), T is a group G₂The element of (1);

e₂(V, T) ═ e (T, V), where V is group G₂In (1), T is a group G₁The element of (1);

the method involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device;

the first side has [1, n-1]]Inner integer secret c, k, calculated as Q ═ ck]P_j+[c]P_pubjOr Q ═ k]P_j+[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jThe master key of (1);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

the first party sends S, Q to the second party;

second party calculates g₁＝e_i(S,P_j)，g₂＝e_i(S, Q), then g₁、g₂Sending to the first party;

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value of (S, P);

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value modes of (S, P) include:

if Q is calculated as Q ═ ck]P_j+[c]P_pubjThen calculate t ═ h₁-k)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ c (h)₁-k))mod n，u＝((g₁^t)g₂)^c^-1；

If Q is calculated as Q ═ k]P_j+[c]P_pubjThen, calculate t ═ h₁-c^-1k)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ (ch)₁-k)mod n，u＝((g₁^t)g₂)^c^-1；

In the above calculation, ^ represents an exponentiation, c^-1The modulo n multiplication inverse of c.

2. A pairing operation system for a resource-restricted device based on the pairing operation method for a resource-restricted device of claim 1, characterized in that:

the pairing operation system comprises a resource-limited device and a non-resource-limited device, and when the resource-limited device needs to perform pairing operation u-e_i(S, P) when the resource-restricted device is a first party and the non-resource-restricted device is a second party, performing pairing operation u-e according to the pairing operation method for the resource-restricted device_iAnd (S, P) calculation.

3. A pairing operation method for a resource-limited device is characterized by comprising the following steps:

the method involves a bilinear map e: g₁×G₂→G_T(ii) a Group G₁、G₂To add the group, group G_TIs a multiplicative group; group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is group G₁Chinese character of (1)T is a group G₂The element of (1);

e₂(V, T) ═ e (T, V), where V is the group G₂In (1), T is a group G₁The element of (1);

the method involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device;

the first side has [1, n-1]]Inner integer secret b, c, k, calculated as Q₁＝[b]P_j，Q₂＝[ck]P_j+[c]P_pubjOr Q₂＝[k]P_j+[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jThe master key of (1); b and c do not have to be different;

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iIn the formula (II), P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first party S, Q₁、Q₂Sending to the second party;

second party calculates g₁＝e_i(S,Q₁)，g₂＝e_i(S,Q₂) Then g is added₁、g₂Sending to the first party;

first party utilizes g₁、g₂Calculating to obtain u-e_iThe value of (S, P);

first party utilizes g₁、g₂Calculating to obtain u-e_iThe manner of the value of (S, P) includes:

if Q₂Is calculated as Q₂＝[ck]P_j+[c]P_pubjThen, t ═ h is calculated₁-k)b^-1)mod n，u＝(g₁^t)(g₂^c^-1) Or, alternatively, calculate t ═ c (h)₁-k)b^-1)mod n，u＝((g₁^t)g₂)^c^-1；

If Q₂Is calculated as Q₂＝[k]P_j+[c]P_pubjThen, t ═ h is calculated₁-c^-1k)b^-1)mod n，u＝(g₁^t)(g₂^c^-1) Alternatively, t ═ is calculated ((ch)₁-k)b^-1)mod n，u＝((g₁^t)g₂)^c^-1；

In the above calculation, ^ represents an exponentiation, b^-1Is the inverse of the modulo n multiplication of b, c^-1The modulo n multiplication inverse of c.

4. A pairing operation system for a resource-restricted device based on the pairing operation method for a resource-restricted device of claim 3, characterized in that:

the pairing operation system comprises a resource-limited device and a non-resource-limited device, and when the resource-limited device needs to perform pairing operation u-e_i(S, P) when the resource-restricted device is the first party and the non-resource-restricted device is the second party, the pairing operation u-e is completed according to the pairing operation method for the resource-restricted device_iAnd (S, P) calculation.

5. A pairing operation method for a resource-limited device is characterized in that:

the method involves a bilinear map e: g₁×G₂→G_T(ii) a Group G₁、G₂As additive group, group G_TIs a multiplicative group; group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is group G₁In (1), T is a group G₂The element of (1);

e₂(V, T) ═ e (T, V), where V is group G₂In (1), T is a group G₁The element of (1);

the method involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device;

the first side has [1, n-1]]Inner integer secret c, calculated with Q₁＝[c]P_j，Q₂＝[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jThe master key of (1);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first, calculate Q ═ h₁]Q₁+Q₂S, Q to the second party;

second party calculates u₁＝e_i(S, Q), mixing u₁Occurs to the first party;

first calculate u ═ u₁^(c^-1) Wherein ^ represents power operation, c^-1Is the modulo n multiplication inverse of c.

6. A pairing operation system for a resource-restricted device based on the pairing operation method for a resource-restricted device of claim 5, characterized in that:

the pairing operation system comprises a resource-limited device and a non-resource-limited device, and when the resource-limited device needs to perform pairing operation u-e_i(S, P) when the resource-restricted device is the first party and the non-resource-restricted device is the second party, the pairing operation u-e is completed according to the pairing operation method for the resource-restricted device_iAnd (S, P) calculation.

7. A pairing operation method for a resource-limited device is characterized by comprising the following steps:

the method involves bilinear mapping e: g₁×G₂→G_T(ii) a Group G₁、G₂To add the group, group G_TIs a multiplicative group; group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is group G₁In (1), T is a group G₂Element (b) of (1);

e₂(V, T) ═ e (T, V), where V is group G₂In (1), T is a group G₁The element of (1);

the method involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device;

the first side has [1, n-1]]Inner integer secret c, k, calculated with Q₁＝[c]P_j，Q_k＝[ck]P_j+[c]P_pubjWherein]Represents a pair group G₁And G₂Multiple point addition of the element(s) in (1), j being 2 or 1, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jThe master key of (1);

at each pairing operation e_iBefore (S, P), the first party calculates Q_r＝[r]Q₁Wherein r is [1, n-1]]Internal and external secret integers, and for each pairing operation e_i(S, P), r are different;

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first, calculate b ═ r^-1(h₁-k)) mod n, where r^-1Is the modulo n multiplication inverse of r;

the first party is to convert S, b, Q_r、Q_kSending to the second party;

second party calculates u₁＝e_i(S,[b]Q_r+Q_k) Will u₁Occurs to the first party;

first calculate u ═ u₁^(c^-1) Wherein ^ represents power operation, c^-1Is the modulo n multiplication inverse of c.

8. A pairing operation system for a resource-restricted device based on the pairing operation method for a resource-restricted device of claim 7, characterized in that:

the pairing operation system comprises a resource-limited device and a non-resource-limited device, and when the resource-limited device needs to perform pairing operation u-e_i(S, P) when the resource-restricted device is the first party and the non-resource-restricted device is the second party, the pairing operation u-e is completed according to the pairing operation method for the resource-restricted device_iAnd (S, P) calculation.

9. A pairing operation method for a resource-limited device is characterized by comprising the following steps:

the method involves a bilinear map e: g₁×G₂→G_T(ii) a Group G₁、G₂As additive group, group G_TIs a multiplicative group; group G₁、G₂、G_TThe order of (a) is a prime number n; group G₁、G₂Are respectively P₁、P₂；

Based on the bilinear map e definition:

e₁(V, T) ═ e (V, T), where V is the group G₁In (1), T is a group G₂The element of (1);

e₂(V, T) ═ e (T, V), where V is the group G₂In (1), T is a group G₁Element (b) of (1);

the method involves two parties: a first party and a second party, wherein the first party is a resource-constrained device and the second party is a non-resource-constrained device;

the first party has a group G_iSelected foreign security element P_zI is 1 or 2, calculated as g_z1＝e_i(P_z,P_j)^-1，g_z2＝e_i(P_z,P_pubj)^-1Wherein j is 3-i, P_pubj＝[s_j]P_jIs a group G_jMaster public key in (1), s_jTo a group G_jThe master key of (1);

when the first party needs to calculate u-e_i(S, P) wherein i is 3-j and S is a group G_iWherein, P ═ h₁]P_j+P_pubj，h₁Is [1, n-1]]The first party and the second party perform pairing operation u-e as follows_iCollaborative computation of (S, P):

first party calculates S₁＝[c](S+P_z) Or S₁＝[c]S+P_z，g_z＝(g_z1^h₁)g_z2Wherein c is a first moiety in [ n-1]]Inner integer secret, or calculation S₁When the first party is [1, n-1]]An internal randomly selected integer, wherein ^ represents power operation;

first party h₁、S₁Sending to the second party;

second calculation of P ═ h₁]P_j+P_pubj，u₁＝e_i(S₁P), then u is added₁Sending to the first party;

first party utilizes u₁Calculated u-e_i(S, P) value;

first party utilizes u₁Calculated u-e_iThe manner of (S, P) values includes:

if calculating S₁Using the formula S₁＝[c](S+P_z) Then, calculate u ═ u (u)₁^c^-1)g_z；

If calculating S₁Using the formula S₁＝[c]S+P_zThen, calculate u ═ u (u)₁g_z)^c^-1；

In the above calculation, c^-1The modulo-n multiplication inverse of c;

above-mentioned G_iSelected foreign security element P_zIs an initialization at group G_iSelecting randomly the elements; from G_iIn randomly selecting a member P_zThe method comprises the following steps: in [1, n-1]]Randomly selects one from the listInteger z, calculating P_z＝[z]P_i，g_z1＝e_i(P_i,P_j)^-z，g_z2＝e_i(P_i,P_pubj)^-z。

10. A pairing operation system for a resource-restricted device based on the pairing operation method for a resource-restricted device of claim 9, characterized in that:

the pairing operation system comprises a resource-limited device and a non-resource-limited device, and when the resource-limited device needs to perform pairing operation u-e_i(S, P) when the resource-restricted device is the first party and the non-resource-restricted device is the second party, the pairing operation u-e is completed according to the pairing operation method for the resource-restricted device_iAnd (S, P) calculation.