KR101455299B1 - Method for processing transitive signature - Google Patents

Abstract

A method for processing transitive signature in a network including user terminals in the form of a non-directional graph includes: generating a random matrix based on the trap door generation algorithm and a public key generated for the first user terminal based on the corresponding trap door matrix And receiving a signature key from the first user terminal based on the public key and the signature key of the first user terminal and the connection line information to the second user terminal, the lattice extracted by the first user terminal according to the Gaussian sampling algorithm And generating a vector as a signature for a message that the first user terminal transmits to the second user terminal.

Description

{METHOD FOR PROCESSING TRANSITIVE SIGNATURE}

The present invention relates to a lattice-based transitive signature processing method.

The Transitive Signature technique was first established in 2002 by Micali and Rivest. Unlike the generic signature scheme, which performs signatures on messages, the transitive signature scheme performs signatures on the edges of nodes in the transitional closed graph.

)과 연결선(j, k) 에 대한 서명(

)이 주어졌을 경우, 서명키 없이 공개키만을 가지고 연결선(i, k) 에 대한 서명(

)을 계산해낼 수 있어야 한다는 특징을 가진다. 즉, 세개의 정점(i, j, k)으로 이루어진 그래프에서, 두 개의 연결선((i, j), (j,k))에 기초하여, 나머지 연결선(i,k)에 대한 서명을 획득할 수 있게 된다.The transitive signature scheme is a signature (i, j)

) And the signature (j, k) for the connection line (j, k)

), The signature (i, k) of the connection line (i, k) with only the public key

) Can be calculated. That is, in the graph consisting of the three vertexes (i, j, k), a signature for the remaining connection line (i, k) is acquired based on the two connection lines ((i, j), .

A relationship diagram consisting of vertices and connection lines can be very effective in expressing relationships between objects. For example, the relationships between managers and employees can be efficiently represented in a computer network structure installed in a specific organization. When such a relationship diagram is utilized, it may be inconvenient to re-sign the entire relationship diagram when the relationship is changed due to the deletion / addition of the node due to the dynamic nature of the relationship diagram. The transitive signature technique is known to be a method that can reflect the dynamic characteristics of the relationship diagram in such cases.

  The transitive signature technique is divided into a case where the graph to be signed is undirected and a case where it is directed, and the present invention relates to a transitive signature processing method in a non-directional graph.

  Transitive signature schemes for non - directed graphs have been designed based on the difficulties of RSA cryptography and factorization problems. Transitive signature schemes, which are based on the difficulty of RSA cryptography and factoring problems, all suffer from the disadvantage of requiring computations that are less efficient, such as exponential computation.

In this regard, Korean Patent Publication No. 2007-0082313 (entitled "Trendy Signing Method Based on RSA Cipher Assumption") is a transitory signature method based on a strong RSA assumption, and through mathematical modeling, And provides a way to verify the accuracy of satisfying the signature method of the signer.

SUMMARY OF THE INVENTION The present invention is directed to overcoming the problems of the prior art described above, and it is an object of some embodiments of the present invention to provide a method capable of processing transitional signatures based on lattices.

According to a first aspect of the present invention, there is provided a transitive signature processing method, which is performed in a network including user terminals in a non-directional graph form, Receiving the public key and the signature key generated for the first user terminal based on the random matrix and the corresponding trapdoor matrix, and transmitting the public key and the signature key of the first user terminal to the second user terminal Generating a lattice vector extracted by the first user terminal according to the Gaussian sampling algorithm as a signature for a message transmitted from the first user terminal to the second user terminal based on connection line information for the user terminal .

According to the present invention, it is possible to perform transitive signature processing in a network having a non-directional graph form based on lattice. When designing based on lattice, it is advantageous to have high computational efficiency because it is composed of linear operations. In addition, the difficult problems present in Lattice are known to be difficult problems in the worst case, and they have the advantage of providing greater safety when based on them.

1 and 2 are views for explaining the concept of transitional signature used in an embodiment of the present invention.
3 is a diagram illustrating a system for providing transitive signatures in accordance with one embodiment of the present invention.
4 is a flowchart illustrating a transitive signature processing method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

1 and 2 are views for explaining the concept of transitional signature used in an embodiment of the present invention.

) 정보가 생성되어 메시지와 함께 전송될 수 있다.In the general signature method as shown in FIG. 1 (a), a signature is generated to confirm that the message is generated by a user terminal that transmits the message to each user terminal 1 to 5. That is, between two different terminals (i, j), a signature

) Information may be generated and transmitted with the message.

However, in this case, since signature information is generated for every terminal constituting the network, it may be difficult to manage a signature in a network including a plurality of terminals or being added or deleted in a flexible manner.

Thus, the concept of the transitivity signature processing method as shown in Fig. 1 (b) has been presented. That is, based on the signature generated for the second user terminal by the first user terminal and the signature generated for the third user terminal by the second user terminal, the signature information for the third user terminal of the first user terminal is generated can do.

)을 생성하는 단계, 서명 검증 모듈(TVf)을 이용하여 서명(

)을 검증하는 단계, 서명 결합 모듈(Comp)을 이용하여 서로 다른 두 서명을 결합하여 새로운 서명을 생성하는 단계를 수행할 수 있다. 2, generating the public key tpk and the secret key tsk by using the key generation module TKG and using the signature generation module TSign, Signatures between two different user terminals (

, A signature verification module (TVf) to generate a signature

), And combining the two different signatures using the signature combining module (Comp) to generate a new signature.

In other words, unlike a conventional signature method, a new signature can be generated by combining two different signatures satisfying transitionability.

3 is a diagram illustrating a system for providing transitive signatures in accordance with one embodiment of the present invention.

The transitivity signature providing system 10 includes a key generation server 110 and a plurality of user terminals 120-140.

The user terminal may be implemented as a computer or a portable terminal capable of accessing the key generation server 110 through a network. Here, the computer includes, for example, a notebook computer, a desktop computer, a laptop computer, a tablet PC, and the like, each of which is equipped with a web browser (WEB Browser) (PCS), Global System for Mobile communications (GSM), Personal Digital Cellular (PDC), Personal Handyphone System (PHS), Personal Digital Assistant (PDA), International Mobile Telecommunication (IMT) Based wireless communication devices such as CDMA (Code Division Multiple Access) -2000, W-CDMA (W-CDMA), Wibro (Wireless Broadband Internet) terminals, smart phones and the like .

3 refers to a hardware component such as software or an FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit), and performs predetermined roles .

However, 'components' are not meant to be limited to software or hardware, and each component may be configured to reside on an addressable storage medium and configured to play one or more processors.

Thus, by way of example, an element may comprise components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, Routines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

The components and functions provided within those components may be combined into a smaller number of components or further separated into additional components.

The key generation server 110 generates a public key pk and a signature key sk according to a request from the user terminals 120 to 140 and provides the public key pk and the signature key sk to the user terminal. For example, the key generation server 110 may be installed in a PKI (Public Key Infrastructure) based key generation organization, but is not limited thereto. At this time, the key generation method based on the public key is an asymmetric encryption or signature scheme in which a pair of keys corresponding to each other is generated, the public key is used for encryption or signature verification, and the secret key is used for decryption or signature. Since it is to prove who sent the message, when signing a message, it can be signed with a secret key and confirmed with a corresponding public key. That is, the secret key serves as a seal for the document. Therefore, in a conventional public key based environment, a user other than the party sending and receiving a message can confirm who signed the message.

The key generation server 110 generates a public key and a signature key based on the random matrix generated according to the trap door generation algorithm and the trapdoor door matrix corresponding thereto.

The encryption and digital signature system is built on mathematical difficulties that are difficult to solve if there is no specific information, the transitional signature system 10 according to an embodiment of the present invention can be used for a small integer solution (SIS) problem on a lattice, It is based on the difficulty of learning with errors (LWE) problems.

If there is no specific information, it is difficult to solve, meaning that the operation is unidirectional. Unidirectionality is very difficult to obtain the inverse of an operation even though the operation is easy, and it is easy to find the inverse of the operation if it has specific information. This specific information is called a trapdoor.

For example, a cryptographic operation in a public key based environment is performed using a unidirectional operation which is easy to encrypt but its reverse conversion is very difficult when there is no decryption key corresponding to the encryption key used in the encryption. That is, the decryption key corresponding to the encryption key used in the encryption is the trap door. Once the message is encrypted, the encryption key can not be decrypted even if it is present, so the encryption key may be disclosed. On the other hand, the trap door or decryption key should not be revealed. Thus, the information used to create the trap door in a public key based environment is disclosed as a public key, and the trap door is not disclosed as a secret key.

Accordingly, the transit signature system 10 according to an embodiment of the present invention generates a trap door to be used as a signature key of each user, wherein the trap door is the base of the lattice.

The SIS problem and the LWE problem based on Lattice are one of mathematical difficulties that can not be solved even in the worst case as described above. Lattices are a set of all points created by linear combination of vectors in a base. Even if a third party (C) finds a point without knowing the base, it is very difficult to find out the closest lattice point from the point. Further, if the base is not known, the third party C has an advantage that it is very difficult to find a lattice point within a specific length.

, 양의 정수 q를 입력 받아서 트랩도어 생성 알고리즘(

)을 통해, 균일한 분포를 가지는 랜덤 행렬(

)을 생성하고, 이에 대응되는 트랩도어 행렬(

)을 생성한다. 그리고, 키 생성 서버(110)는 해시함수

를 선택한다. 그리고, 이에 기초하여 공개키 및 서명키를 생성하는데, 공개키는 랜덤 행렬 및 해시함수를 포함하고

), 서명키는 트랩도어 행렬(

)이다. For example, the key generation server 110 may include a security parameter n,

, A positive integer q is input to the trap door generation algorithm (

), A random matrix having a uniform distribution (

), And generates a trapdoor matrix (

). Then, the key generation server 110 generates a hash function

. Then, based on this, a public key and a signature key are generated. The public key includes a random matrix and a hash function

), The signature key is a trapdoor matrix (

)to be.

Each of the user terminals 120 to 140 includes a signature generation unit 122, 132, 142 for generating a signature, a signature verification unit 124, 134, 144 for verifying the signature, and a signature combining unit 126, 136, 146). For simplicity of explanation, each detailed component will be described with reference to the first user terminal 120. [

), 자신의 서명키(

) 및 제 1 사용자 단말(120)과 제 2 사용자 단말(130) 사이의 연결선(i, j) 정보에 기반하여, 가우시안 샘플링 알고리즘(

)을 사용하여 래티스 벡터(

)를 샘플링한다. 이때, 가우시안 샘플링 알고리즘은 랜덤 행렬(

), 트랩도어 행렬(

), 벡터(

), 가우시안 파라미터 s를 입력받아서, 미리 설정된 아래 수학식 1 및 2 를 만족시키는 래티스 벡터를 샘플링한다.The signature generation unit 122 generates a signature according to the Gaussian sampling algorithm based on the public key, the signature key, and the connection information of the user terminal received from the key generation server 110. For example, if a first user terminal 120 generates a signature for a message sent to the second user terminal 130,

), His signature key (

(I, j) information between the first user terminal 120 and the second user terminal 130 and the Gaussian sampling algorithm

) Was used as a lattice vector (

). At this time, the Gaussian sampling algorithm is a random matrix

), Trap door matrix (

), Vector (

) And receives the Gaussian parameter s, and samples a lattice vector satisfying the following Equations (1) and (2) below.

[Equation 1]

&Quot; (2) "

이다.As such, the extracted lattice vector is used as a signature for the message that the first user terminal 120 has sent to the second user terminal 130. [ At this time,

to be.

), 연결선 정보 및 메시지에 대한 서명 정보에 기초하여 서명의 정당성 여부를 검증할 수 있다. 예를 들어, 서명 검증부(124)는 제 2 사용자 단말(130)의 공개키 및 제 2 사용자 단말(130)이 제 3 사용자 단말(140)에 전송한 메시지에 대한 서명 정보에 기초하여, 해당 서명이 제 2 사용자 단말(130)에 의하여 수행된 것임을 검증한다.The signature verification unit 124 verifies the signature generated by the other user terminal. That is, the public key of another user terminal

), The legitimacy of the signature can be verified based on the connection information and the signature information on the message. For example, based on the public key of the second user terminal 130 and the signature information on the message transmitted to the third user terminal 140 by the second user terminal 130, And verifies that the signature has been performed by the second user terminal 130.

), 검증 대상 서명이 전달된 연결선(i, j) 에 대한 정보 및 서명 정보(

)를 입력 받아, 미리 설정된 아래 수학식 3 및 4 를 만족시키는지 여부에 기초하여 서명을 검증한다. The signature verification unit 124 verifies the signer's public key (

), Information about the connection line (i, j) to which the verification target signature is transmitted, and signature information (

), And verifies the signature based on whether or not the predetermined equations (3) and (4) are satisfied.

&Quot; (3) "

&Quot; (4) "

)가 정당한 서명인 것으로 판단한다.That is, if all the expressions (3) and (4) are satisfied, the signature information

) Is a legitimate signature.

The signature combining unit 126 may combine two or more different signatures satisfying the transitivity to generate a new signature. That is, the signature generated by the user terminal 1 and the signature generated by the user terminal 2, between the user terminal 1 and the user terminal 3, To generate a signature between the user terminal 1 and the user terminal 3. [

), 연결선 (i,j)와 연결선(j,k)에 대한 정보, 연결선 각각에 대한 서명(

,

)를 입력 받아, 하기 수학식 5에 따라 새로운 서명을 생성한다.For example, each signer's public key (

), Information about connecting lines (i, j) and connecting lines (j, k), signatures

,

), And generates a new signature according to the following equation (5).

&Quot; (5) "

The background in which a new signature can be generated by combining two different signatures as shown in Equation (5) is expressed by Equation (6) below.

&Quot; (6) "

이다.At this time, the combined signature

to be.

As such, each user terminal included in the transitional signature system 10 of the present invention can perform signature, signature verification, signature combination according to the lattice-based transitive signature processing method.

4 is a flowchart illustrating a transitive signature processing method according to an embodiment of the present invention.

First, the key generation server 110 generates a public key and a signature key at the request of the user terminal (S410). As described above, the public key and the signature key are generated based on the random matrix generated according to the trap door generation algorithm and the corresponding trap door matrix. The public key includes a random matrix and a hash function, and the signature key is a trap door matrix, which is a matrix of a series of lattice vectors.

Next, a signature is generated at each user terminal based on the public key and the signature key (S420). For example, the first user terminal 120 generates a signature for a message to be transmitted to the second user terminal 130, based on its public key and signature key. At this time, a lattice vector satisfying equations (1) and (2) is extracted according to a Gaussian sampling algorithm, and the extracted lattice vector is used as a signature.

The signature of each user terminal can be generated through this process.

Next, a new signature is generated by combining different signatures (S430).

That is, the signature of the message transmitted from the first user terminal 120 to the second user terminal 130 and the signature of the message transmitted from the second user terminal 130 to the third user terminal 140 are combined , And may generate a signature for a message that the first user terminal 120 has sent to the third user terminal 140.

On the other hand, for each signature thus generated, verification of the signature can be performed using the extraction process of the lattice vector. That is, verification is performed by checking whether or not the mathematical formulas (3) and (4) are satisfied, based on the signer's public key and signature information.

One embodiment of the present invention may also be embodied in the form of a recording medium including instructions executable by a computer, such as program modules, being executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

10: transitivity signature system 110: key generation server
120: user terminal 122: signature generator
124: signature verification unit 126: signature verification unit

Claims (8)

A method for processing a transitive signature in a network including user terminals in a non-directional graph form,
The first user terminal receiving a public key and a signature key generated for a first user terminal based on a random matrix generated according to a trap door generation algorithm and a corresponding trapdoor matrix;
The first user terminal transmits the lattice vector extracted according to the Gaussian sampling algorithm to the second user terminal based on the public key and the signature key of the first user terminal and the connection line information to the second user terminal Generating as a signature for a message to be transmitted;
The second user terminal transmits the lattice vector extracted by the second user terminal according to the Gaussian sampling algorithm to the third user terminal based on the public key and the signature key of the second user terminal and the connection line information to the third user terminal, As a signature for a message to be sent to
Wherein the first user terminal combines a signature for a message to be transmitted to the second user terminal and a signature for a message to be transmitted to the third user terminal by the second user terminal, And generating a signature for a message to be transmitted to the terminal. The method according to claim 1,
Wherein the public key comprises the random matrix,
Wherein the signature key is the trapdoor matrix. delete The method according to claim 1,
Wherein the step of generating the lattice vector as a signature computes a lattice vector (v) satisfying Equation (1) according to the Gaussian sampling algorithm.
[Equation 1]

,

A: random matrix, q: positive integer, s: Gaussian parameter, m: dimension, u: vector delete The method according to claim 1,
Based on the public key of the first user terminal, the connection line information between the first user terminal and the second user terminal, and the signature information on the message transmitted to the second user terminal by the first user terminal, The method comprising the steps of: The method according to claim 6,
Wherein the step of verifying whether or not the signature is valid judges that the signature is legitimate when both of the following expressions (2) and (3) are satisfied.
&Quot; (3) "

&Quot; (4) "

A: random matrix, i, j: connection line information, q: positive integer, s: Gaussian parameter, m: dimension, H: A computer-readable recording medium recording a program for performing the method according to any one of claims 1, 2, 4, 6, and 7 on a computer.

Images