CN113536378B - Traceable attribute-based purifiable signature method and system - Google Patents

Abstract

The invention relates to a traceable attribute-based cleanable signature method and a system, wherein the method comprises the following steps: the attribute authorization terminal outputs a master key, a tracking key and a public parameter, and then outputs a private key of the signature terminal according to the master key, the public parameter, the attribute of the signature terminal and the identity of the signature terminal; the signature end inputs the attribute of the signature end, the private key of the signature end, the signature strategy, the attribute of the purifying end, the public parameters and the information, and outputs a signature and secret value set; the purifying terminal inputs the cleanup message index, the message, the public parameter, the signature terminal attribute, the purifying terminal attribute and the secret value set sent by the signature terminal, and outputs the cleanup message and the cleanup signature; the verification terminal inputs a purified message signature pair, a public parameter, a signature terminal attribute and a purification terminal attribute, and verifies the validity of the signature; the attribute authorization terminal inputs the purified message signature pair and the tracking key, and outputs the identity of the signature terminal. The method and the system can recover the identity of the signature end and modify the sensitive information in the signature to generate the purified signature.

Description

Traceable attribute-based purifiable signature method and system

Technical Field

The present invention belongs to the field of Internet security technology, and in particular relates to a traceable attribute-based purifiable signature method and system.

Background Art

Internet technology has penetrated all walks of life and has been widely used in e-health, e-government, and e-finance. In these application scenarios, physical devices inevitably collect and analyze user data, including the user's real identity, the patient's medical health status, and some sensitive data information such as personal financial transfer details, which inevitably involves the problem of user privacy leakage. Attribute-based signature (ABS) is an important method to solve the above problems. It plays an important role in privacy protection, access control, and data authentication. However, in the ABS scheme, on the one hand, the attribute authorization end cannot restore the identity of the signing end when the signature is abused, and reveal the malicious behavior of signature abuse, that is, it cannot provide traceability. On the other hand, when it is necessary to modify the sensitive information in the signature to hide the sensitive information in the signature, the traditional ABS scheme cannot provide purifiability.

Summary of the invention

The purpose of the present invention is to provide a traceable attribute-based purifiable signature method and system, which can restore the identity of the signing end and modify the sensitive information in the signature to generate a purified signature.

To achieve the above object, the technical solution adopted by the present invention is: a traceable attribute-based purifiable signature method, comprising the following steps:

Step S1: The attribute authorization end inputs the security parameter λ and outputs the master key msk, the tracking key TK and the public parameter params;

Step S2: The attribute authorization end inputs the master key msk, the public parameter params, the signature end attribute set _ωa and the signature end identity u, and outputs the signature end private key

签名策略(ω,d,γ)、净化端属性集合ω_b、公开参数params和消息m，输出签名σ和秘密值集合SI；Step S3: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, γ), purification end attribute set ω _b , public parameters params and message m, output signature σ and secret value set SI;

Step S4: the purification end inputs the purifiable message index set _IS , message m, public parameter params, signature σ, signature end attribute set _ωa , purification end attribute set _ωb and secret value set SI sent by the signature end, and outputs the purified message m' and purified signature σ';

Step S5: The verification end inputs the purified message signature pair (m', σ'), public parameter params, signature end attribute set ω _a and purification end attribute set ω _b , verifies the validity of the signature, and outputs accept if the signature is valid, otherwise outputs reject;

Step S6: The attribute authorization end inputs the purified message signature pair (m', σ') and the tracking key TK, and outputs the signing end identity u.

Furthermore, the step S1 specifically includes the following steps:

且i∈S，定义拉格朗日系数

其中Z_n＝{0,1,2,3,…,n-1}；Step S11: The attribute authorization terminal inputs the security parameter λ, randomly selects large prime numbers p and q, and sets q as the tracking key, that is, TK = q; calculates n = pq, so that |n| = λ; G and _GT are two multiplicative cyclic groups of order n; e:G×G→ _GT is a bilinear mapping, _Gp , _Gq are subgroups of G of order p and q respectively; defines the threshold value as d; set

And i∈S, define the Lagrange coefficient

Where Z _n ={0,1,2,3,…,n-1};

计算g₁＝g^α，其中g是G的生成元，

Step S12: Random selection of attribute authorization end

Compute g ₁ =g ^α , where g is a generator of G,

其中u_i是G的生成元，i∈{1,…,v}；签名端身份u用长为v的二进制字符串表示，令u[i]表示u的第i个比特，定义

为满足u[i]＝1的序号的集合，定义W(u)＝u'Π_i∈Uu_i；Step S13: The attribute authorization terminal randomly selects an element g ₂ in G, a generator h of G _q , a generator u′ of G, and a vector of v elements

Where u _i is a generator of G, i∈{1,…,v}; the signature end identity u is represented by a binary string of length v, let u[i] represent the i-th bit of u, and define

For the set of serial numbers satisfying u[i]=1, define W(u)=u'Π _i∈U u _i ;

其中i∈K，K＝{1,2,…,k,k+1}，其中选取

Step S14: The attribute authorization end randomly selects t _i ∈ G and defines

where i∈K, K＝{1,2,…,k,k+1}, and select

计算w'＝g^y'，

Step S15: The attribute authorization terminal randomly selects y'∈Z _n and _yi , where

Calculate w'= ^gy' ,

Step S16: The attribute authorization terminal outputs the master key msk=α and public parameters

Furthermore, the step S2 specifically includes the following steps:

签名端属性集合ω_a和签名端身份u，其中

Step S21: The attribute authorization terminal inputs the master key msk=α and the public parameter

The signature end attribute set ω _a and the signature end identity u, where

Step S22: The attribute authorization terminal randomly selects s∈Z _n for each user u and calculates _Du,0 = g ^s , _Du,1 = h ^s

Step S23: The attribute authorization end selects a d-1 degree polynomial q(x) that satisfies q(0) = α; for i∈ω _a , the attribute authorization end randomly selects _{ri∈Z n} and calculates

Step S24: The attribute authorization end outputs the signature end private key

Furthermore, the step S3 specifically includes the following steps:

签名策略(ω,d,Υ)、净化端属性集合ω_b、公开参数params和消息m；Step S31: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, Υ), purification end attribute set ω _b , public parameters params and message m;

再随机选择默认子集

令

其中|ω'_a|≥d，|ω'_b|≥d，ω'_a∩Ω'_a＝φ，ω'_b∩Ω'_b＝φ；其中Ω＝{ω₁,…,ω_d-1}，其中ω_i∈Z_n；Step S32: Signature end random selection

Then randomly select the default subset

make

Where |ω' _a |≥d, |ω' _b |≥d, ω' _a ∩Ω' _a =φ, ω' _b ∩Ω' _b =φ; where Ω={ω ₁ ,…,ω _d-1 }, where ω _i ∈Z _n ;

签名端计算：Step S33: For each bit u[i] (i=1,…,v) of identity u, the signature end randomly selects θ _i ∈ Z _n and calculates

Signature end calculation:

其中i∈I_s，

表示签名端允许净化端净化的消息索引集合；令

表示秘密值集合，|I_s|表示集合I_s中元素的个数；Step S34: The signature end randomly selects s' ₁ ∈Z _n , sets s ₁ =s+s'₁; calculates the secret value

where i∈I _s ,

Represents the message index set that the signing end allows the purifying end to purify;

represents a set of secret values, |I _s | represents the number of elements in the set I _s ;

签名端随机选取r'_i∈Z_n；对所有

签名端随机选取r”_i∈Z_n，签名端计算：Step S35: For all

The signature end randomly selects r' _i ∈ Z _n ; for all

The signature end randomly selects r” _i ∈Z _n and calculates:

Step S36: the signature end outputs a signature: σ = (σ ₀ , σ ₁ , σ _ai , σ _bi , c, c ₁ , .. , c _v , π ₁ , … , π _v ).

Furthermore, the step S4 specifically includes the following steps:

Step S41: the purification end inputs the purifiable message index set _IS , the message m, the public parameter params, the signature σ, the signature end attribute set _ωa , the purification end attribute set _ωb and the secret value set SI sent by the signature end;

令集合I₁＝{i∈I:m_i＝0,m’_i＝1},I₂＝{i∈I:m_i＝1,m’_i＝0}；Step S42: The purification end defines the message index set that needs to be purified

Let the set I ₁ ={i∈I:m _i =0,m' _i =1}, I ₂ ={i∈I:m _i =1,m' _i =0};

计算：Step S43: The purification end selects a random number

calculate:

Step S44: the purification end outputs a purified signature: σ' = (σ' ₀ , σ' _ai , σ' _bi , σ' ₁ , c, c ₁ , ..., c _v , π ₁ , ..., π _v ).

Furthermore, the step S5 specifically includes the following steps:

Step S51: The verification end inputs the purified message signature pair (m', σ'), public parameter params, signature end attribute set ω _a and purification end attribute set ω _b ;

Step S52: The verification end calculates:

是否成立，若成立输出accept，否则输出reject。Step S53: The verification end determines the equation:

Is it true? If so, output accept, otherwise output reject.

Furthermore, the step S6 specifically includes the following steps:

Step S61: the attribute authorization terminal inputs the purified message signature pair (m', σ') and the tracking key q;

Step S62: the attribute authorization terminal calculates ( _ci ) ^q for each _ci ; if ( _ci ) ^q = ^g0 , then u[i] = 0; if (ci ₎ ^q = (u _i ) ^q , then u[i] = 1;

Step S63: The attribute authorization end outputs the signature end identity u.

The present invention also provides a traceable attribute-based purifiable signature system for implementing the above method, comprising:

还用于根据签名σ和追踪密钥TK，确定签名端身份u；The attribute authorization end is used to generate the master private key msk, the tracking key TK and the public parameter params; it is used to generate the signature end private key according to the master private key msk, the public parameter params, the signature end attribute set ω _a and the signature end identity u

It is also used to determine the identity u of the signing end based on the signature σ and the tracking key TK;

净化端属性集合ω_b和公共参数params，产生签名σ和秘密值集合SI；The signature end is used to generate a signature based on the message m, signature strategy (ω, d, Υ), signature end attribute set ω _a , and signature end private key

Purify the end attribute set ω _b and public parameters params, generate the signature σ and the secret value set SI;

A purification end, used to generate a purified message m' and a purified signature σ' according to the purgeable message index set I _S , the message m, the public parameter params, the signature σ, the signature end attribute set ω _a , the purification end attribute set ω _b and the secret value set SI sent by the signature end; and

The verification end is used to verify the validity of the signature according to the purified message signature pair (m', σ'), the public parameter params, the signature end attribute set ω _a and the purification end attribute set ω _b .

Compared with the prior art, the present invention has the following beneficial effects: the present invention is based on the attribute-based signature design, the private key of the signing end is associated with the signing end attributes and identity, the access policy is embedded in the signature, and if the attributes meet the access policy, the user can generate a valid signature; the purification end can modify the sensitive information in the signature and regenerate the signature to achieve the hiding of sensitive information. In addition, when the signing end abuses the signature, the attribute authorization end can reveal malicious behavior by tracking the identity of the signer. The verification end is sure that a specific signature is created by a group of possible users, and the attributes of these users match the access policy, so as not to disclose the identity information of the signer. Therefore, the proposed method and system have strong practicality and broad application prospects in data authentication and privacy protection access control.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a system architecture diagram according to an embodiment of the present invention.

DETAILED DESCRIPTION

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and/or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and/or combinations thereof.

This embodiment provides a traceable attribute-based purifiable signature method, including the following steps:

Step S1: The attribute authorization end inputs the security parameter λ and outputs the master key msk, the tracking key TK and the public parameter params.

In this embodiment, step S1 specifically includes the following steps:

且i∈S，定义拉格朗日系数

其中Z_n＝{0,1,2,3,…,n-1}。Step S11: The attribute authorization terminal inputs the security parameter λ, randomly selects large prime numbers p and q, and sets q as the tracking key, that is, TK = q; calculates n = pq, so that |n| = λ; G and _GT are two multiplicative cyclic groups of order n; e:G×G→ _GT is a bilinear mapping, _Gp , _Gq are subgroups of G of order p and q respectively; defines the threshold value as d; set

And i∈S, define the Lagrange coefficient

Where _Zn = {0, 1, 2, 3, ..., n-1}.

计算g₁＝g^α，其中g是G的生成元，

Step S12: Random selection of attribute authorization end

Calculate g ₁ = g ^α , where g is the generator of G,

其中u_i是G的生成元，i∈{1,…,v}；签名端身份u用长为v的二进制字符串表示，令u[i]表示u的第i个比特，定义

为满足u[i]＝1的序号的集合，定义W(u)＝u'∏_i∈Uu_i。Step S13: The attribute authorization terminal randomly selects an element g ₂ in G, a generator h of G _q , a generator u' of G, and a vector of v elements

Where u _i is a generator of G, i∈{1,…,v}; the identity u of the signer is represented by a binary string of length v, let u[i] represent the i-th bit of u, and define

For the set of serial numbers satisfying u[i]=1, define W(u)=u'∏ _i∈U u _i .

其中i∈K，K＝{1,2,…,k,k+1}，其中选取

Step S14: The attribute authorization end randomly selects t _i ∈ G and defines

Where i∈K, K＝{1,2,…,k,k+1}, among which select

计算w'＝g^y’，

Step S15: The attribute authorization terminal randomly selects y'∈Z _n and _yi , where

Calculate w'= ^gy' ,

Step S16: The attribute authorization terminal outputs the master key msk=α and public parameters

Step S2: The attribute authorization end inputs the master key msk, the public parameter params, the signature end attribute set _ωa and the signature end identity u, and outputs the signature end private key

In this embodiment, step S2 specifically includes the following steps:

签名端属性集合ω_a和签名端身份u，其中

Step S21: The attribute authorization terminal inputs the master key msk=α and the public parameter

The signature end attribute set ω _a and the signature end identity u, where

Step S22: The attribute authorization end randomly selects s∈Z _n for each user u and calculates _Du,0 = g ^s , _Du,1 = h ^s .

Step S23: The attribute authorization end selects a d-1 degree polynomial q(x) that satisfies q(0) = α; for i∈ω _a , the attribute authorization end randomly selects _{ri∈Z n} and calculates

Step S24: The attribute authorization end outputs the signature end private key

签名策略(ω,d,γ)、净化端属性集合ω_b、公开参数params和消息m，输出签名σ和秘密值集合SI。Step S3: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, γ), purification end attribute set ω _b , public parameters params and message m, output signature σ and secret value set SI.

In this embodiment, step S3 specifically includes the following steps:

签名策略(ω,d,Υ)、净化端属性集合ω_b、公开参数params和消息m。Step S31: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, Υ), purification end attribute set ω _b , public parameters params and message m.

再随机选择默认子集

令

其中|ω'_a|≥d，|ω'_b|≥d，ω'_a∩Ω'_a＝φ，ω'_b∩Ω'_b＝φ；其中Ω＝{ω₁,…,ω_d-1}，其中ω_i∈Z_n。Step S32: Signature end random selection

Then randomly select the default subset

make

Where |ω' _a |≥d, |ω' _b |≥d, ω' _a ∩Ω' _a =φ, ω' _b ∩Ω' _b =φ; where Ω={ω ₁ ,…,ω _d-1 }, where ω _i ∈Z _n .

签名端计算：Step S33: For each bit u[i] (i=1,…,v) of identity u, the signature end randomly selects θ _i ∈ Z _n and calculates

Signature end calculation:

其中i∈I_s，

表示签名端允许净化端净化的消息索引集合。令

表示秘密值集合，|I_s|表示集合I_s中元素的个数。Step S34: The signature end randomly selects s′ ₁ ∈Z _n , sets s ₁ =s+s′ ₁ ; calculates the secret value

where i∈I _s ,

Represents the message index set that the signing end allows the purifying end to purify.

represents a set of secret values, and |I _s | represents the number of elements in the set I _s .

签名端随机选取r′_i∈Z_n；对所有

签名端随机选取r″_i∈Z_n，签名端计算：Step S35: For all

The signature end randomly selects r′ _i ∈Z _n ; for all

The signature end randomly selects r″ _i ∈Z _n and calculates:

Step S36: the signature end outputs a signature: σ = (σ ₀ , σ ₁ , σ _ai , σ _bi , c, c ₁ , .. , c _v , π ₁ , … , π _v ).

Step S4: The purification end inputs the purifiable message index set _IS , message m, public parameter params, signature σ, signature end attribute set _ωa , purification end attribute set _ωb and secret value set SI sent by the signature end, and outputs the purified message m′ and purified signature σ′.

In this embodiment, step S4 specifically includes the following steps:

Step S41: the purification end inputs the purifiable message index set _IS , the message m, the public parameter params, the signature σ, the signature end attribute set _ωa , the purification end attribute set _ωb and the secret value set SI sent by the signature end.

令集合I₁＝{i∈I:m_i＝0,m’_i＝1},I₂＝{i∈I:m_i＝1,m’_i＝0}。Step S42: The purification end defines the message index set that needs to be purified

Let the set I ₁ ={i∈I:m _i =0, m' _i =1}, I ₂ ={i∈I:m _i =1, m' _i =0}.

计算：Step S43: The purification end selects a random number

calculate:

Step S44: the purification end outputs a purified signature: σ' = (σ' ₀ , σ' _ai , σ' _bi , σ' ₁ , c, c ₁ , ..., c _v , π ₁ , ..., π _v ).

Step S5: The verification end inputs the purified message signature pair (m', σ'), public parameters params, the signing end attribute set ω _a and the purification end attribute set ω _b , verifies the validity of the signature, and outputs accept if the signature is valid, otherwise outputs reject.

In this embodiment, step S5 specifically includes the following steps:

Step S51: the verification end inputs the purified message signature pair (m', σ'), public parameters params, the signature end attribute set ω _a and the purification end attribute set ω _b .

Step S52: The verification end calculates:

是否成立，若成立输出accept，否则输出reject。Step S53: The verification end determines the equation:

Is it true? If so, output accept, otherwise output reject.

Step S6: The attribute authorization end inputs the purified message signature pair (m′, σ′) and the tracking key TK, and outputs the signing end identity u.

In this embodiment, step S6 specifically includes the following steps:

Step S61: The attribute authority inputs the purified message signature pair (m', σ') and the tracking key q.

Step S62: The attribute authorization end calculates ( _ci ) ^q for each _ci ; if ( _ci ) ^q = ^g0 , then u[i] = 0; if (ci ₎ ^q = (u _i ) ^q , then u[i] = 1.

Step S63: The attribute authorization end outputs the signature end identity u.

As shown in FIG1 , this embodiment further provides a traceable attribute-based purifiable signature system for the above method, including:

还用于根据签名σ和追踪密钥TK，确定签名端身份u；The attribute authorization end is used to generate the master private key msk, the tracking key TK and the public parameter params; it is used to generate the signature end private key according to the master private key msk, the public parameter params, the signature end attribute set ω _a and the signature end identity u

It is also used to determine the identity u of the signing end based on the signature σ and the tracking key TK;

净化端属性集合ω_b和公共参数params，产生签名σ和秘密值集合SI；The signature end is used to generate a signature based on the message m, signature strategy (ω, d, Υ), signature end attribute set ω _a , and signature end private key

Purify the end attribute set ω _b and public parameters params, generate the signature σ and the secret value set SI;

A purification end, used to generate a purified message m′ and a purified signature σ′ according to a set of purifiable message indexes I _S , a message m, public parameters params, a signature σ, a set of signature end attributes ω _a , a set of purification end attributes ω _b and a set of secret values SI sent by the signature end; and

The verification end is used to verify the validity of the signature according to the purified message signature pair (m′, σ′), the public parameter params, the signature end attribute set ω _a and the purification end attribute set ω _b .

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims (2)

1. A traceable attribute-based purifiable signature method, comprising the following steps: Step S1: The attribute authorization end inputs the security parameter λ and outputs the master key msk, the tracking key TK and the public parameter params; Step S2: The attribute authorization end inputs the master key msk, the public parameter params, the signature end attribute set _ωa and the signature end identity u, and outputs the signature end private key

Step S3: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, γ), purification end attribute set ω _b , public parameters params and message m, output signature σ and secret value set SI; Step S4: The purification end inputs the purifiable message index set _IS , message m, public parameter params, signature σ, signature end attribute set _ωa , purification end attribute set _ωb and secret value set SI sent by the signature end, and outputs the purified message m′ and purified signature σ′; Step S5: The verification end inputs the purified message signature pair (m′, σ′), public parameter params, signature end attribute set ω _a and purification end attribute set ω _b , verifies the validity of the signature, and outputs accept if the signature is valid, otherwise outputs reject; Step S6: The attribute authorization end inputs the purified message signature pair (m′, σ′) and the tracking key TK, and outputs the signature end identity u; The step S1 specifically includes the following steps: Step S11: The attribute authorization terminal inputs the security parameter λ, randomly selects large prime numbers p and q, and sets q as the tracking key, that is, TK=q; calculates n=pq, so that |n|=λ; G and _GT are two multiplicative cyclic groups of order n; e: G×G→ _GT is a bilinear mapping, _Gp , _Gq are subgroups of G of order p and q respectively; defines the threshold value as d; set

And i∈S, define the Lagrange coefficient

Where _Zn = {0, 1, 2, 3, ..., n-1}; Step S12: Random selection of attribute authorization end

Calculate g ₁ = g ^α , where g is the generator of G,

{1, 2, 3, ..., n-1}; Step S13: The attribute authorization terminal randomly selects an element g ₂ in G, a generator h of G _q , a generator u′ of G, and a vector of v elements

Where u _i is a generator of G, i∈{1,...,v}; the identity u of the signer is represented by a binary string of length v, let u[i] represent the i-th bit of u, and define

For the set of serial numbers satisfying u[i]=1, define

Step S14: The attribute authorization end randomly selects t _i ∈ G and defines

where i∈K, K＝{1, 2, ..., k, k+1}, and

Step S15: The attribute authorization terminal randomly selects y′∈Z _n and _yi , where

i∈{1,...,l}, calculate w′=gy ^′ ,

Step S16: The attribute authorization terminal outputs the master key msk=α and public parameters

The step S2 specifically comprises the following steps: Step S21: The attribute authorization terminal inputs the master key msk=α and the public parameter

The signature end attribute set ω _a and the signature end identity u, where

Step S22: The attribute authorization terminal randomly selects s∈Z _n for each user u and calculates _Du,0 = g ^s , _Du,1 = h ^s Step S23: The attribute authorization end selects a d-1 degree polynomial q(x) that satisfies q(0) = α; for i∈ω _a , the attribute authorization end randomly selects _{ri∈Z n} and calculates

Step S24: The attribute authorization end outputs the signature end private key

The step S3 specifically comprises the following steps: Step S31: The signing end inputs the signing end attribute set ω _a and the signing end private key

Signature strategy (ω, d, γ), purification end attribute set ω _b , public parameters params and message m; Step S32: Signature end random selection

Then randomly select the default subset

make

Where |ω′ _a |≥d, |ω′ _b |≥d, ω′ _a ∩Ω′ _a =φ, ω′ _b ∩Ω′ _b =φ; where Ω={ω ₁ ,...,ω _d-1 }, where ω _i ∈Z _n ; Step S33: For each bit u[i] (i=1, ..., v) of identity u, the signature end randomly selects θ _i ∈ Z _n and calculates

Signature end calculation:

Step S34: The signature end randomly selects s′ ₁ ∈Z _n , sets s ₁ =s+s′ ₁ ; calculates the secret value

where i∈I _s ,

Represents the message index set that the signing end allows the purifying end to purify;

represents a set of secret values, |I _s | represents the number of elements in the set I _s ; Step S35: For all

The signature end randomly selects r′ _i ∈Z _n ; for all

The signature end randomly selects r″ _i ∈Z _n and calculates:

Step S36: the signature end outputs a signature: σ = (σ ₀ , σ ₁ , σ _ai , σ _bi , c, c ₁ , .. , c _v , π ₁ , ... , π _v ); The step S4 specifically comprises the following steps: Step S41: the purification end inputs the purifiable message index set _IS , the message m, the public parameter params, the signature σ, the signature end attribute set _ωa , the purification end attribute set _ωb and the secret value set SI sent by the signature end; Step S42: The purification end defines the message index set that needs to be purified

Let the set I ₁ ={i∈I: m _i =0, m′ _i =1}, I ₂ ={i∈I: m _i =1, m′ _i =0}; Step S43: The purification end selects a random number

calculate:

Step S44: the purification end outputs a purified signature: σ′=(σ′ ₀ , σ′ _ai , σ′ _bi , σ′ ₁ , c, c ₁ , ..., c _v , π ₁ , ..., π _v ); The step S5 specifically comprises the following steps: Step S51: The verification end inputs the purified message signature pair (m′, σ′), public parameter params, signature end attribute set ω _a and purification end attribute set ω _b ; Step S52: The verification end calculates:

Step S53: The verification end determines the equation:

Is it true? If so, output accept, otherwise output reject; The step S6 specifically comprises the following steps: Step S61: the attribute authorization terminal inputs the purified message signature pair (m′, σ′) and the tracking key q; Step S62: the attribute authorization end calculates ( _ci ) ^q for each _ci ; if ( _ci ) ^q = ^g0 , then u[i] = 0; if (ci ₎ ^q = (u _i ) ^q , then u[i] = 1; Step S63: The attribute authorization end outputs the signature end identity u. 2. A traceable attribute-based purifiable signature system for implementing the method of claim 1, comprising: The attribute authorization end is used to generate the master private key msk, the tracking key TK and the public parameter params; it is used to generate the signature end private key according to the master private key msk, the public parameter params, the signature end attribute set ω _a and the signature end identity u

It is also used to determine the identity u of the signing end based on the signature σ and the tracking key TK; The signature end is used to generate a signature based on the message m, signature strategy (ω, d, γ), signature end attribute set ω _a , and signature end private key.

Purify the end attribute set ω _b and public parameters params, generate the signature σ and the secret value set SI; A purification end, used to generate a purified message m′ and a purified signature σ′ according to a set of purifiable message indexes I _S , a message m, public parameters params, a signature σ, a set of signature end attributes ω _a , a set of purification end attributes ω _b and a set of secret values SI sent by the signature end; and The verification end is used to verify the validity of the signature according to the purified message signature pair (m′, σ′), the public parameter params, the signature end attribute set ω _a and the purification end attribute set ω _b .

Images