CN117034357A - Aggregation signature method for data compliance audit - Google Patents

Abstract

The invention discloses an aggregate signature method for data compliance audit, which comprises the following steps: step 1, initializing a system; step 2, generating a key of a trusted third party; step 3, generating a secret key of the submitter; step 4, generating a secret key of the auditor; step 5, generating a certificate of the auditor; step 6, submitting a document stage by a presenter; step 7, a signature stage of an auditor; step 8, aggregating and signing the phase of the auditor; step 9, a compliance auditing suspension stage; step 10, storing the document. The method protects personal information leakage of auditors by hiding attribute values in the audit strategy; the signature of a single auditor is aggregated by means of the aggregated signature, the effective storage rate of the auditing flow document is improved, the implementation is simple, the practicability is high, and the method is suitable for safety application of auditing the same data document by multiple auditors under an exact access strategy in a data compliance auditing flow.

Description

Aggregation signature method for data compliance audit

Technical Field

The invention relates to the technical field of data security, in particular to an aggregation signature method for data compliance auditing.

Background

Data compliance auditing: data compliance auditing refers to the auditing and assessment of data held, processed or transmitted by an organization or individual to ensure compliance with applicable legal regulations, industry standards, and internal policy requirements. This process involves auditing practices in data collection, storage, use, sharing, and destruction to identify potential compliance risks and violations, and to propose improved suggestions and solutions to ensure the legitimacy, security, and confidentiality of the data. Compliance audits aim to protect personal privacy, adhere to data protection laws, prevent data leakage and abuse, and establish sustainable compliance management measures.

Aggregate signature: aggregate signatures are a cryptographic technique that can combine multiple signatures into a single signature. Unlike a traditional single signature, an aggregate signature can represent multiple signers, while providing a more efficient and compact signature verification method.

When the data is checked for compliance, the aggregate signature can be used for verifying whether the data is tampered in the transmission or storage process, the auditor can sign the data and aggregate the signatures into a single signature, and the auditor can verify the integrity of the data by utilizing the aggregate signature in the checking flow, so that the data is ensured not to be modified without authorization. In a specific data auditing process, the same auditor can audit the data document submitted by a certain submitter for multiple times, the same auditor can sign the same nuclear power emergency data document for multiple times, the problem that the auditing process document is low in effective storage is caused, and the storage problem can be effectively reduced by aggregating the multiple signatures.

Disclosure of Invention

Aiming at the aim that in a data compliance auditing scene, when an auditor carries out auditing access, an auditing strategy is disclosed, an attacker can easily omit obtaining personal information of the auditor through the disclosed auditing strategy, so that partial content of a data document is inferred, partial important data leakage can be possibly caused, and privacy protection is required for the personal information of the auditor; and the problems of multiple interaction revisions and complex logic exist in the auditing process, the same auditor can audit the same data document for multiple times, and the auditing signature and auditing opinion in the auditing process document can be excessive, so that the auditor signature and auditing opinion in the auditing process document can be repeatedly stored, and the effective storage rate of the auditing process document is low, thereby providing an aggregate signature method for data compliance auditing. The method protects personal information leakage of auditors by hiding attribute values in the audit strategy; the signature of a single auditor is aggregated by means of the aggregated signature, the effective storage rate of the auditing flow document is improved, the implementation is simple, the practicability is high, and the method is suitable for safety application of auditing the same data document by multiple auditors under an exact access strategy in a data compliance auditing flow.

The technical scheme for realizing the aim of the invention is as follows:

an aggregate signature method for data compliance audit comprises the following steps:

step 1, initializing a system: generating system public parameters according to the input safety parameters;

step 2, key generation of a trusted third party: key generation center generates public key PK _TA And private key SK _TA And PK is combined with _TA Sending the generated secret key to a auditor secret key generation center;

step 3, generating a secret key of a submitter: key generation center generates public key PK _submit And private key SK _submit ；

Step 4, secret key generation of auditors: key generation center generates public key PK _audit And private key SK _audit ；

Step 5, certificate generation of auditors: certificate generation center generates certificate cre= { K, CL, { K _aduit(i) }}；

Step 6, submitting a document stage by a presenter: the presenter performs signature operation on the submitted nuclear power emergency data document to prevent the data from being maliciously tampered by other presenters;

step 7, signature stage of auditor: the system conceals the auditing strategy, judges whether the auditor accords with the auditing access strategy, and joins the auditor group after the auditing access strategy accords with the auditing access strategy; the first auditor receiving the data document verifies the correctness of the signature of the submitter by using a verification equation, and then the first auditor performs data compliance audit, and the step 9 is executed if the data compliance audit is not passed; after signature operation is carried out, the document is sent to the next auditor, the next auditor verifies the correctness of the aggregate signature of the last auditor by using a verification equation, then compliance audit is carried out on the data document to be audited, the audit is passed, the step 8 is executed, and the step 9 is executed without passing the audit;

step 8, an aggregate signature stage of auditors: if the document passes the data compliance audit, the auditor aggregates the signature and the signature of the last auditor;

step 9, a compliance verification suspension stage: if the document does not pass the data compliance audit, the auditor suspends the audit flow, carries out the operation of suspending audit signature, and returns the data document and audit opinion which do not pass the audit to the data document submitter;

step 10, storing a document: and the auditor group stores the data document passing the compliance audit and the audit flow document into a high-security database.

The system initialization in the step 1 comprises the following steps:

1.1 Inputting a security parameter lambda, the trusted third party randomly selects p.apprxeq.poly (1) ^λ ) Then outputs phi by using the complex order bilinear parameter generator, wherein phi comprisesP, q, r in the generator are three different large primes, G _T Is a subgroup of multiplication cycles of order N, G _p ,G _q ,G _r Is a subgroup of G, < >>Representing a bilinear map;

1.2 Selecting and generating 3 hash functions, H ₁ :G ₁ ->Z _n ，H ₂ :{0,1} ^* ->Z _n ，H ₃ :{0,1} ^* ->G _T ，H ₄ :{0,1} ^* ->G, wherein {0,1} ^* For binary code sets of arbitrary length, Z _n Is an integer cyclic group;

1.3 Randomly selecting t for all auditor attribute values participating in a process _att(i,j) ∈Z _n Wherein i represents the attribute name, j represents the attribute value under the i attribute name, and B is randomly selected _i(j) ∈G _q Calculation ofEach attribute value corresponds to a B _i(j) Finally, a set of global attribute names is obtained

1.4 Generating common parameters

The key generation of the trusted third party in the step 2 comprises the following steps:

2.1 A trusted third party key generation center selects two random numbers alpha, mu epsilon Z _n Private key SK as a trusted third party _TA = (α, μ) and then calculateLet->Calculate->Let->Finally calculate->Finally, Y' is used as public key PK of trusted third party _TA = (Y, Y'), and public key PK _TA Disclosed are methods and apparatus for controlling the flow of liquid.

The key generation of the submitter in the step 3 comprises the following steps:

3.1 Random selection of c, d e Z by key generation center _n Private key SK as submitter _submit = (c, d) and then calculateLet->Recalculate cdY 'let Z' = cdY ', eventually take Z, Z' as the public key PK of the submitter _submit = (Z, Z') and public key PK _submit Disclosure of;

the key generation of the auditor in the step 4 comprises the following steps:

4.1 Random selection of a, b e Z by key generation center _n Private key SK as auditor _audit = (a, b), then calculateLet->Recalculate abY 'with X' = abY ', eventually taking X, X' as the public key PK of the auditor _audit = (X, X') and public key PK _audit Disclosed are methods and apparatus for controlling the flow of liquid.

The certificate generation of the auditor in the step 5 comprises the following steps:

5.1 Certificate generation center randomly selects t e Z _n Calculation of

5.2 Certificate generation centerRandomly select P ε G _r Calculation of

5.3 A certificate generation center generates a unique certificate set for each auditor, and randomly selects R _i ∈G _r To generate a certificate sets _i Representing the value to which the auditor attribute value is mapped into the integer group;

5.4 Certificate generation center generates cre= { K, CL, { K _aduit(i) }}。

The submitting document stage of the presenter in the step 6 comprises the following steps of;

6.1 Randomly choosing r e Z by submitter _p Nuclear power emergency data m epsilon {0,1} ^* Private key SK _audit The system parameter params is used as input;

6.2 Submitter calculates signature sigma _submit ＝(σ _s1 ,σ _s2 ) Wherein:

σ _s1 ＝r,σ _s2 ＝H ₄ (m,r) ^cd ；

6.3 Submitter will sign (sigma) _submit M) and the data document are sent to the first auditor of the auditing group.

The signature stage of the auditor in the step 7 comprises the following steps:

7.1 Hiding access strategy of auditor, i.e. APOL, and attribute value H in APOL _i(j) Hidden conversion toAnd the converted access strategy of the auditor is disclosed;

7.2 The first auditor in the auditing process needs to verify the signature operation, and verifies:

e(σ _s2 ,g)＝e(H ₄ (m,r),Z′)；

7.3 After the equation verification is passed, the auditor performs compliance data audit;

7.4 After the verification is passed, signature operation is carried out, then the signature and the data are sent to the next verifier, and if the verification is not passed, a compliance verification suspension stage is executed;

7.5 If it is other auditor, the following operations are executed;

7.6 Auditor calculationWherein is sigma _i∈l λ _i ω _i ＝s，{λ _i -a valid analysis of secret s;

7.7 Auditor calculation

7.8 Verifying and calculating the aggregate signature of the reviewer i-1 by the reviewer i):

if the formula (1) is established, performing the next verification calculation;

7.9 Verification calculation by auditor i

If the formula (2) is established, the aggregate signature is correct, the following operation is executed, otherwise, the aggregate signature is refused, the data compliance auditing operation is stopped, and a compliance auditing suspension stage is entered;

7.10 Using a Lewko-Waters algorithm to generate a map P (i) of the attributes in the APOL, the Lewko-Waters algorithm being a representation of the Boolean expression of the APOL converted into a form of a matrix M;

7.11 Random selection of y by auditor ₂ ,y ₃ ,...,y _l ∈Z _n ,s _aduit Is the secret parameter that the reviewer wants to share, where s _aduit ∈Z _n L is the number of attributes in the auditor access policy, and the auditor gets the vector v=(s) _aduit ,y ₂ ,y ₃ ,...,y _l )；

7.12 I=1, 2, 3.., attribute values in the i region, and λ using the i-th row calculation of the auditor to obtain vector v and M of the auditor access policy transformation _i Finally get lambda ₁ ，λ ₂ ,...,λ _l ；

7.13 Random selection of r by auditor ₁ ,r ₂ ,...,r _x ∈Z _n Where x.epsilon.1..i.,. Randomly selecting Z for each attribute value _0,x ∈G _q Z is selected randomly for the attribute names corresponding to the attribute value sets _1,x ∈G _q ；

7.14 Auditor calculates attribute code { { { C _i,x },D _i,x }, whereinWherein H is _i(j) The jth attribute value, C, representing the ith attribute name for each attribute value _i,x An attribute code corresponding to the x-th attribute value corresponding to the i-th attribute name, D _i,x The attribute code corresponding to the ith attribute name;

7.15 Reviewers view whether the document to be reviewed is compliant with the data and give comments M _aduit And calculate C ₁ ＝g _p ^s And performs the following operations;

7.16 Randomly selecting U, U epsilon Z by auditors _p Delta is calculated =u| PK _audit ||PK _TA ||m||M _id ，Wherein m is the data document to be audited;

7.17 Auditor calculationWhere h=ab.

The aggregate signature stage of the auditor in the step 8 comprises the following steps:

8.1 Initializing signature generation (1) for a first auditor _G ,1 _G ,1 _G ,1 _G ) In (1) _G ,1 _G ,1 _G ,1 _G ) Aggregating the signatures on the basis of the aggregate signatures of the ith-1 th auditor if the ith auditor is the same (delta) _aduit(i-1) ，δ _a ，δ _b ，δ _c ) Polymerizing on the basis;

8.2 Randomly selecting r, x epsilon Z by auditors _n Calculate delta _b ′＝δ _b +rg，δ _c ′＝δ _c +xg；

8.3 Auditor calculates delta _a ′＝xδ _b ′+rδ _c +SK _audit-i,1 SK _audit,2 H ₂ (δ _aduit-i ||m)g；

8.4 Final auditor gets the aggregate signature (delta) _aduit(i) ，δ _a ，δ _b ，δ _c )。

The compliance verification suspension stage in step 9 includes the following steps:

9.1 Randomly selecting a c E {0,1} by the auditor, and calculating the signature sigma of the auditor with respect to the data document _m Wherein sigma _m ＝(δ _aduit(i) ,σ ₁ ,σ ₂ )＝(δ _aduit(i) ,c,H ₃ (δ _aduit(i) ,c) ^ab )；

9.2 Submitter verification):

if the formula (3) is true, continuing to verify:

e(σ ₂ ,g _p )＝e(H ₃ (δ _aduit(i) ,σ ₁ ),X) (4)

if the formula (4) is satisfied, the audit interrupt signature is correct, otherwise, the audit interrupt signature is refused.

Based on the complexity of CDH difficult problems, the access control strategy and the linear secret sharing technology provide a method of the technical scheme, and the method of the technical scheme conceals the access strategy of the auditor and increases the privacy of personal information of the auditor. Meanwhile, a plurality of signatures of the same data document are aggregated, so that the length of the signatures is reduced to a certain extent, the length of the aggregated signatures is independent of the number of auditors, and the storage space of the audit flow document is saved. In conclusion, the technical scheme is simple to implement and high in practicability, and is suitable for safety application of auditing the same data documents by multiple auditors under an exact access strategy in a data compliance auditing process.

The method is based on technologies such as linear secret sharing, aggregation signature and the like, can solve the problems of low effective storage rate and personal information leakage in the auditing process, provides technical guarantee for personal information protection in the data compliance auditing process, realizes the aggregation signature with complex interaction logic in the data compliance auditing, reduces partial redundancy of auditing flow documents, effectively reduces storage load, and improves the reliability and safety of the data compliance auditing.

Drawings

FIG. 1 is a schematic diagram of an embodiment;

fig. 2 is a flow chart of an embodiment.

Detailed Description

The invention will now be described in further detail with reference to the drawings and specific examples, which are not intended to limit the invention thereto.

Examples:

mathematical theory applied to this example:

cdh difficult problem:

the CDH has the difficult problems that a cyclic multiplication group G with the order of n is selected under the safety parameter lambda, and a, b epsilon Z is randomly selected _n Will (g) ^a ,g,g ^b ) As input, then output DH _gn (g ^a ,g ^b )＝g ^ab If algorithm A is present, the computational advantage is Pr [ A (g ^a ,g,g ^b )＝g ^ab ]And ∈is not less than, and the CDH difficulty problem is solved.

Lewko-Waters algorithm

The Lewko-Waters algorithm is a general algorithm that converts the Boolean formula into an equivalent LSSS matrix. The algorithm treats the boolean formula as an access number, where the internal nodes are AND OR gates AND the leaf nodes represent the corresponding attributes. First the root node of the access number is de-marked with vector (1), i.e. a vector of length 1. The vector of its child nodes is then de-labeled with the vector of the parent node in the top-to-bottom direction. And a global variable count is maintained and initialized to 1.

Vector labels for child nodes are scored as two cases:

when the parent of the marked node is an OR gate marked by a vector v, then this example also marks its child node with v (and keeps the value of counter unchanged).

When the parent node of the marked node is an AND gate marked by a vector v, the end of v is filled with 0, so that the length of v becomes counter, AND if v=counter, the end is not complemented with 0. The left child node of the parent node is labeled with (0,..0) | -1, with the number of 0 being counter. The right child node of the parent node is marked with v 1, and after marking of the left and right child nodes is completed, the value of counter is added with 1.

When the whole access tree is marked, the vectors of the marked leaf nodes form rows of the matrix, which are then assembled into an access matrix.

Referring to fig. 1 and 2, an aggregate signature method for data compliance auditing includes the following steps:

step 1, initializing a system: generating system public parameters according to the input safety parameters;

step 2, key generation of a trusted third party: trusted third party key generation center generates public key PK _TA And private key SK _TA And PK is combined with _TA Sending the generated secret key to a auditor secret key generation center;

step 3, generating a secret key of a submitter: key generation center generates public key PK _submi And private key SK _submit ；

Step 4, secret key generation of auditors: key generation center generates public key PK _audit And private key SK _audit ；

Step 5, certificate generation of auditors: certificate generation center generates certificate cre= { K, CL, { K _aduit(i) }}；

Step 6, submitting a document stage by a presenter: the submitter performs signature operation on the submitted data document to prevent the data from being maliciously tampered by other submitters;

step 7, signature stage of auditor: the system conceals the auditing strategy, judges whether the auditor accords with the auditing access strategy, and joins the auditor group after the auditing access strategy accords with the auditing access strategy; the first auditor receiving the data document verifies the correctness of the signature of the submitter by using a verification equation, and then the first auditor performs data compliance audit, and the step 9 is executed if the data compliance audit is not passed; after signature operation is carried out, the document is sent to the next auditor, the next auditor verifies the correctness of the aggregate signature of the last auditor by using a verification equation, then compliance audit is carried out on the data document to be audited, the audit is passed, the step 8 is executed, and the step 9 is executed without passing the audit;

step 8, an aggregate signature stage of auditors: if the document passes the data compliance audit, the auditor aggregates the signature and the signature of the last auditor;

step 9, a compliance verification suspension stage: if the document does not pass the data compliance audit, the auditor suspends the audit flow, carries out the operation of suspending audit signature, and returns the data document and audit opinion which do not pass the audit to the data document submitter;

step 10, storing a document: and the auditor group stores the data document passing the compliance audit and the audit flow document into a high-security database.

The system initialization in the step 1 comprises the following steps:

1.1 Inputting a security parameter lambda, the trusted third party randomly selects p.apprxeq.poly (1) ^λ ) Then outputs phi by using the complex order bilinear parameter generator, wherein phi comprisesP, q, r in the generator are three different large primes, G _T Is a stepIs a subgroup of multiplication cycles of N, G _p ,G _q ,G _r Is a subgroup of G, < >>Representing a bilinear map;

1.2 Selecting and generating 3 hash functions, H ₁ :G ₁ ->Z _n ，H ₂ :{0,1} ^* ->Z _n ，H ₃ :{0,1} ^* ->G _T ，H ₄ :{0,1} ^* ->G, wherein {0,1} ^* For binary code sets of arbitrary length, Z _n Is an integer cyclic group;

1.3 Randomly selecting t for all auditor attribute values participating in a process _att(i,j) ∈Z _n Wherein i represents the attribute name, j represents the attribute value under the i attribute name, and B is randomly selected _i(j) ∈G _q Calculation ofEach attribute value corresponds to a B _i(j) Finally, a set of global attribute names is obtained

1.4 Generating common parametersThe key generation of the trusted third party in the step 2 comprises the following steps:

2.1 A trusted third party key generation center selects two random numbers alpha, mu epsilon Z _n Private key SK as a trusted third party _TA = (α, μ) and then calculateLet->Calculate->Let->Finally calculate->Finally, Y' is used as public key PK of trusted third party _TA = (Y, Y'), and public key PK _TA Disclosed are methods and apparatus for controlling the flow of liquid.

The key generation of the submitter in the step 3 comprises the following steps:

3.1 Random selection of c, d e Z by key generation center _n Private key SK as submitter _submit = (c, d) and then calculateLet->Recalculate cdY 'let Z' = cdY ', eventually take Z, Z' as the public key PK of the submitter _submit = (Z, Z') and public key PK _submit Disclosure of;

the key generation of the auditor in the step 4 comprises the following steps:

4.1 Random selection of a, b e Z by key generation center _n Private key SK as auditor _audit = (a, b), then calculateLet->Recalculate abY 'with X' = abY ', eventually taking X, X' as the public key PK of the auditor _audit = (X, X') and public key PK _audit Disclosed are methods and apparatus for controlling the flow of liquid.

The certificate generation of the auditor in the step 5 comprises the following steps:

5.1 Certificate generation center randomly selects t e Z _n Calculation of

5.2 Certificate generation center randomly selects P ε G _r Calculation of

5.3 A certificate generation center generates a unique certificate set for each auditor, and randomly selects R _i ∈G _r To generate a certificate sets _i Representing the value to which the auditor attribute value is mapped into the integer group;

5.4 Certificate generation center generates cre= { K, CL, { K _aduit(i) }}。

The submitting document stage of the presenter in the step 6 comprises the following steps of;

6.1 Randomly choosing r e Z by submitter _p Data m epsilon {0,1} ^* Private key SK _audit The system parameter params is used as input;

6.2 Submitter calculates signature sigma _submit ＝(σ _s1 ,σ _s2 ) Wherein:

σ _s1 ＝r,σ _s2 ＝H ₄ (m,r) ^cd ；

6.3 Submitter will sign (sigma) _submit M) and the data document are sent to the first auditor of the auditing group.

The signature stage of the auditor in the step 7 comprises the following steps:

7.1 Hiding access strategy of auditor, i.e. APOL, and attribute value H in APOL _i(j) Hidden conversion toAnd the converted access strategy of the auditor is disclosed;

7.2 The first auditor in the auditing process needs to verify the signature operation, and verifies:

e(σ _s2 ,g)＝e(H ₄ (m,r),Z′)；

7.3 After the equation verification is passed, the auditor performs compliance data auditing because:

e(σ _s2 ,g)＝e(H ₄ (m,r) ^cd ,g)＝e(H ₄ (m,r),g ^cd )＝e(H ₄ (m,r),Z′)；

7.4 After the verification is passed, signature operation is carried out, then the signature and the data are sent to the next verifier, and if the verification is not passed, a compliance verification suspension stage is executed;

7.5 If it is other auditor, the following operations are executed;

7.6 Auditor calculationWherein is sigma _i∈l λ _i ω _i ＝s，{λ _i -a valid analysis of secret s;

7.7 Auditor calculation

7.8 Verifying and calculating the aggregate signature of the reviewer i-1 by the reviewer i):

if the formula (1) is established, performing the next verification calculation;

7.9 Verification calculation by auditor i

If the formula (2) is satisfied, the aggregate signature is correct, and the following operation is executed, otherwise, the aggregate signature is refused, the data compliance auditing operation is stopped, and the compliance auditing suspension stage is entered because:

7.10 Using a Lewko-Waters algorithm to generate a map P (i) of the attributes in the APOL, the Lewko-Waters algorithm being a representation of the Boolean expression of the APOL converted into a form of a matrix M;

7.11 Random selection of y by auditor ₂ ,y ₃ ,...,y _l ∈Z _n ,s _aduit Is the secret parameter that the reviewer wants to share, where s _aduit ∈Z _n L is the number of attributes in the auditor access policy, and the auditor gets the vector v=(s) _aduit ,y ₂ ,y ₃ ,...,y _l )；

7.12 I=1, 2, 3.., attribute values in the i region, and λ using the i-th row calculation of the auditor to obtain vector v and M of the auditor access policy transformation _i Finally get lambda ₁ ，λ ₂ ,...,λ _l ；

7.13 Random selection of r by auditor ₁ ,r ₂ ,...,r _x ∈Z _n Where x.epsilon.1..i.,. Randomly selecting Z for each attribute value _0,x ∈G _q Z is selected randomly for the attribute names corresponding to the attribute value sets _1,x ∈G _q ；

7.14 Auditor calculates attribute code { { { C _i,x },D _i,x }, whereinWherein H is _i(j) The jth attribute value, C, representing the ith attribute name for each attribute value _i,x An attribute code corresponding to the x-th attribute value corresponding to the i-th attribute name, D _i,x The attribute code corresponding to the ith attribute name; 7.15 Reviewers view whether the document to be reviewed is compliant with the data and give comments M _aduit And calculate C ₁ ＝g _p ^s And performs the following operations;

7.16 Randomly selecting U, U epsilon Z by auditors _p Delta is calculated =u| PK _audit ||PK _TA ||m||M _id ，Wherein m is the data document to be audited;

7.17 Auditor calculationWhere h=ab.

The aggregate signature stage of the auditor in the step 8 comprises the following steps:

8.1 Initializing signature generation (1) for a first auditor _G ,1 _G ,1 _G ,1 _G ) In (1) _G ,1 _G ,1 _G ,1 _G ) Aggregating the signatures on the basis of the aggregate signatures of the ith-1 th auditor if the ith auditor is the same (delta) _aduit(i-1) ，δ _a ，δ _b ，δ _c ) Polymerizing on the basis;

8.2 Randomly selecting r, x epsilon Z by auditors _n Calculate delta _b ′＝δ _b +rg，δ _c ′＝δ _c +xg；

8.3 Auditor calculates delta _a ′＝xδ _b ′+rδ _c +SK _audit,1 SK _audit,2 H ₂ (δ _aduit-i ||m)g；

8.4 Final auditor gets the aggregate signature (delta) _aduit(i) ，δ _a ，δ _b ，δ _c )。

The compliance verification suspension stage in step 9 includes the following steps:

9.1 Randomly selecting a c E {0,1} by the auditor, and calculating the signature sigma of the auditor with respect to the data document _m Wherein sigma _m ＝(δ _aduit(i) ,σ ₁ ,σ ₂ )＝(δ _aduit(i) ,c,H ₃ (δ _aduit(i) ,c) ^ab )；

9.2 Submitter verification):

if the formula (3) is true, continuing to verify:

e(σ ₂ ,g _p )＝e(H ₃ (δ _aduit(i) ,σ ₁ ),X) (4)

if equation (4) holds, the audit interrupt signature is correct, otherwise the audit interrupt signature is rejected because:

e(σ ₂ ,g _p )＝e(H ₃ (δ _aduit(i) ,c) ^ab ,g _p )＝e(H ₃ (δ _aduit(i) ,c),g _p ^ab )＝e(H ₃ (δ _aduit(i) ,σ ₁ ),X)。

Claims (10)

1. an aggregate signature method for data compliance auditing is characterized by comprising the following steps:

step 1, initializing a system: generating system public parameters according to the input safety parameters;

step 2, key generation of a trusted third party: key generation center generates public key PK _TA And private key SK _TA And PK is combined with _TA Sending the generated secret key to a auditor secret key generation center;

step 3, generating a secret key of a submitter: key generation center generates public key PK _submit And private key SK _submit ；

Step 4, secret key generation of auditors: key generation center generates public key PK _audit And private key SK _audit ；

Step 5, certificate generation of auditors: certificate generation center generates certificate cre= { K, CL, { K _aduit(i) }}；

Step 6, submitting a document stage by a presenter: the submitter performs signature operation on the submitted data document to prevent the data from being maliciously tampered by other submitters;

step 7, signature stage of auditor: the system conceals the auditing strategy, judges whether the auditor accords with the auditing access strategy, and joins the auditor group after the auditing access strategy accords with the auditing access strategy; the first auditor receiving the data document verifies the correctness of the signature of the submitter by using a verification equation, and then the first auditor performs data compliance audit, and the step 9 is executed if the data compliance audit is not passed; after signature operation is carried out, the document is sent to the next auditor, the next auditor verifies the correctness of the aggregate signature of the last auditor by using a verification equation, then compliance audit is carried out on the data document to be audited, the audit is passed, the step 8 is executed, and the step 9 is executed without passing the audit;

step 8, an aggregate signature stage of auditors: if the document passes the data compliance audit, the auditor aggregates the signature and the signature of the last auditor;

step 9, a compliance verification suspension stage: if the document does not pass the data compliance audit, the auditor suspends the audit flow, carries out the operation of suspending audit signature, and returns the data document and audit opinion which do not pass the audit to the data document submitter;

step 10, storing a document: and the auditor group stores the data document passing the compliance audit and the audit flow document into a high-security database.

2. The aggregate signature method for data compliance verification of claim 1, wherein the system initialization in step 1 comprises the steps of:

1.1 Inputting a security parameter lambda, the trusted third party randomly selects p.apprxeq.poly (1) ^λ ) Reusing the resultant order bilinear parameter generator to output phi, wherein phi comprisesP, q, r in the generator are three different large primes, G _T Is a subgroup of multiplication cycles of order N, G _p ,G _q ,G _r Is a subgroup of G, < >>Representing a bilinear map;

1.2 Selection of a particular selectionGenerating 3 hash functions H ₁ :G ₁ ->Z _n ，H ₂ :{0,1} ^* ->Z _n ，H ₃ :{0,1} ^* ->G _T ，H ₄ :{0,1} ^* ->G, wherein {0,1} ^* For binary code sets of arbitrary length, Z _n Is an integer cyclic group;

1.3 Randomly selecting t for all auditor attribute values participating in a process _att(i,j) ∈Z _n Wherein i represents the attribute name, j represents the attribute value under the i attribute name, and B is randomly selected _i(j) ∈G _q Calculation ofEach attribute value corresponds to a B _i(j) Finally, a set of global attribute names is obtained

1.4 Generating common parameters

3. The aggregate signature method for data compliance verification of claim 1, wherein the key generation of the trusted third party in step 2 comprises the steps of:

2.1 A trusted third party key generation center selects two random numbers alpha, mu epsilon Z _n Private key SK as a trusted third party _TA = (α, μ) and then calculateLet->Calculate->Let->Finally calculate->Finally, Y' is used as public key PK of trusted third party _TA = (Y, Y'), and public key PK _TA Disclosed are methods and apparatus for controlling the flow of liquid.

4. The aggregate signature method for data compliance verification of claim 1, wherein the generating of the key of the presenter in step 3 comprises the steps of:

3.1 Random selection of c, d e Z by key generation center _n Private key SK as submitter _submit = (c, d) and then calculateLet->Recalculate cdY 'let Z' = cdY ', eventually take Z, Z' as the public key PK of the submitter _submit = (Z, Z') and public key PK _submit Disclosed are methods and apparatus for controlling the flow of liquid.

5. The aggregate signature method for data compliance verification of claim 1, wherein the key generation of the auditor in step 4 comprises the steps of:

4.1 Random selection of a, b e Z by key generation center _n Private key SK as auditor _audit = (a, b), then calculateLet->Recalculate abY 'with X' = abY ', eventually taking X, X' as the public key PK of the auditor _audit = (X, X') and public key PK _audit Disclosed are methods and apparatus for controlling the flow of liquid.

6. The aggregate signature method for data compliance verification of claim 1, wherein the step 5 of generating the certificate of the auditor comprises the steps of:

5.1 Certificate generation center randomly selects t e Z _n Calculation of

5.2 Certificate generation center randomly selects P ε G _r Calculation of

5.3 A certificate generation center generates a unique certificate set for each auditor, and randomly selects R _i ∈G _r To generate a certificate sets _i Representing the value to which the auditor attribute value is mapped into the integer group;

5.4 Certificate generation center generates cre= { K, CL, { K _aduit(i) }}。

7. The aggregate signature method for data compliance verification of claim 1, wherein the submitting document submitting stage of step 6 comprises the steps of:

6.1 Randomly choosing r e Z by submitter _p Nuclear power emergency data m epsilon {0,1} ^* Private key SK _audit The system parameter params is used as input;

6.2 Submitter calculates signature sigma _submit ＝(σ _s1 ,σ _s2 ) Wherein:

σ _s1 ＝r,σ _s2 ＝H ₄ (m,r) ^cd ；

6.3 Submitter will sign (sigma) _submut M) and the nuclear power emergency data document are sent to a first auditor of the auditing group.

8. The aggregate signature method for data compliance verification of claim 1, wherein the signature phase of the auditor in step 7 comprises the steps of:

7.1 Hiding access strategy of auditor, i.e. APOL, and attribute value H in APOL _i(j) Hidden conversion toAnd the converted access strategy of the auditor is disclosed;

7.2 The first auditor in the auditing process needs to verify the signature operation, and verifies:

e(σ _s2 ,g)＝e(H ₄ (m,r),Z′)；

7.3 After the equation verification is passed, the auditor performs compliance data audit;

7.4 After the verification is passed, signature operation is carried out, then the signature and the data are sent to the next verifier, and if the verification is not passed, a compliance verification suspension stage is executed;

7.5 If it is other auditor, the following operations are executed;

7.6 Auditor calculationWherein is sigma _i∈l λ _i ω _i ＝s，{λ _i -a valid analysis of secret s;

7.7 Auditor calculation

7.8 Verifying and calculating the aggregate signature of the reviewer i-1 by the reviewer i):

if the formula (1) is established, performing the next verification calculation;

7.9 Verification calculation by auditor i

If the formula (2) is established, the aggregate signature is correct, the following operation is executed, otherwise, the aggregate signature is refused, the data compliance auditing operation is stopped, and a compliance auditing suspension stage is entered;

7.10 Using a Lewko-Waters algorithm to generate a map P (i) of the attributes in the APOL, the Lewko-Waters algorithm being a representation of the Boolean expression of the APOL converted into a form of a matrix M;

7.11 Random selection of y by auditor ₂ ,y ₃ ,...,y _l ∈Z _n ,s _aduit Is the secret parameter that the reviewer wants to share, where s _aduit ∈Z _n L is the number of attributes in the auditor access policy, and the auditor gets the vector v=(s) _aduit ,y ₂ ,y ₃ ,...,y _l )；

7.12 I=1, 2, 3.., attribute values in the i region, and λ using the i-th row calculation of the auditor to obtain vector v and M of the auditor access policy transformation _i Finally get lambda ₁ ，λ ₂ ,...,λ _l ；

7.13 Random selection of r by auditor ₁ ,r ₂ ,...,r _x ∈Z _n Where x.epsilon.1..i.,. Randomly selecting Z for each attribute value _0,x ∈G _q Z is selected randomly for the attribute names corresponding to the attribute value sets _1,x ∈G _q ；

7.14 Auditor calculates attribute code { { { C _i,x },D _i,x }, whereinH _i(j) The jth attribute value, C, representing the ith attribute name for each attribute value _i,x An attribute code corresponding to the x-th attribute value corresponding to the i-th attribute name, D _i,x The attribute code corresponding to the ith attribute name;

7.15 Reviewers view whether the document to be reviewed is compliant with the data and give comments M _aduit And calculate C ₁ ＝g _p ^s And performs the following operations;

7.16 Randomly selecting U, U epsilon Z by auditors _p Delta is calculated =u| PK _audit ||PK _TA ||m||M _id ，Wherein m is the data document to be audited;

7.17 Auditor calculationWhere h=ab.

9. The aggregate signature method for data compliance verification of claim 1, wherein the aggregate signature phase of the auditor in step 8 comprises the steps of:

8.1 Initializing signature generation (1) for a first auditor _G ,1 _G ,1 _G ,1 _G ) In (1) _G ,1 _G ,1 _G ,1 _G ) Aggregating the signatures on the basis of the aggregate signatures of the ith-1 th auditor if the ith auditor is the same (delta) _aduit(i-1) ，δ _a ，δ _b ，δ _c ) Polymerizing on the basis;

8.2 Randomly selecting r, x epsilon Z by auditors _n Calculate delta' _b ＝δ _b +rg，δ′ _c ＝δ _c +xg；

8.3 Auditor calculates delta' _a ＝xδ′ _b +rδ _c +SK _audit,1 SK _audit-i,2 H ₂ (δ _aduit-i ||m)g；

8.4 Final auditor gets the aggregate signature (delta) _aduit(i) ，δ _a ，δ _b ，δ _c )。

10. The aggregate signature method for data compliance verification of claim 1, wherein the compliance verification suspension phase of step 9 comprises the steps of:

9.1 Auditor withThe machine selects a c E {0,1}, and calculates the signature sigma of the auditor with respect to the data document _m ，

Wherein sigma _m ＝(δ _aduit(i) ,σ ₁ ,σ ₂ )＝(δ _aduit(i) ,c,H ₃ (δ _aduit(i) ,c) ^ab )；

9.2 Submitter verification):

if the formula (3) is true, continuing to verify:

e(σ ₂ ,g _p )＝e(H ₃ (δ _aduit(i) ,σ ₁ ),X) (4)

if the formula (4) is satisfied, the audit interrupt signature is correct, otherwise, the audit interrupt signature is refused.