KR20200136676A - Forward secure sequential aggregate signature method and apparatus thereof - Google Patents

Abstract

Disclosed are an omni-directional safety signature method for supporting sequential joining and a device thereof. The omni-directional safety signature method for supporting sequential joining comprises the steps of: (a) selecting a j^th random value used for signing a j^th message (Mj) at a current time point (t); (b) generating a j^th signature for the j^th message (Mj) using the j^th random value and a t^th secret key for the j-th message (Mj) at the current time point (t); (c) generating a j^th integrated blind variable value using the j^th random value and an integrated blind variable value up to a previous point in time; and (d) generating a joined signature by sequentially joining at least part of the signatures of the previous time points and the j^th signature. The j^th integrated blind variable value may be used for validity verification of the joined signature.

Description

TECHNICAL FIELD [0001] A forward secure sequential aggregate signature method and apparatus thereof supporting sequential combination.

The present invention relates to an omni-directional safety signature method and apparatus for supporting sequential combination.

Recently, various embedded system devices use forward-secure signatures to store the performance record of the device and verify its validity. The omni-directional secure signature scheme is a signature method that minimizes the damage caused by the leakage of the private key by preventing the creation of a signature for a past point in time even if the current private key is leaked. In other words, the forward safety signature technique is a signature technique that maintains the validity of the signature before the current cycle even if the signature corresponding to the current cycle is leaked by creating a separate signature for each cycle.

In this regard, the prior art 1, "A forward-secure digital signature scheme (Mihir Bellare and Sara K Miner)," first proposed an omnidirectional security signature scheme, and the conventional prior art 2, "A new forward-secure" In "digital signature scheme (Michel Abdalla and Leonid Reyzin)", we proposed an omni-directional stable signature scheme based on factoring. In addition, in the prior art 3, "Practical forward secure sequential aggregate signatures (Di Ma)", a technique for verifying by combining the signatures generated in each period into one signature was proposed, and the conventional prior art 4, "FAS : Forward Secure Sequential Aggregate Signatures for Secure Logging (Jihye Kim, Hyunok Oh)" proposed a technique to increase the security of combined signatures.

However, prior art 3 has a disadvantage in that only one signature for one message is generated in each cycle, and after the signature is signed, an update must be performed, and the security of the generated combined signature is not secure.

In addition, prior art 4 has a problem that only one signature per cycle is allowed, and after signing, it has to be automatically updated, and a combined signature can be created except for the current cycle.

The present invention is to provide an omni-directional safety signature method and apparatus for supporting sequential combination capable of sequentially combining signatures generated at each time point.

In addition, the present invention may provide an omnidirectional safety signature method and apparatus for supporting sequential concatenation capable of guaranteeing security for not only each signature but also sequentially combined signatures.

In addition, the present invention may provide a forward safety signature method and apparatus for supporting sequential concatenation capable of verifying the validity of signatures included in the combined signature through a single verification of the combined signature.

In order to achieve the above object, according to a preferred embodiment of the present invention, there is provided a method capable of sequentially combining the respective signatures generated by the forward safety signature technique.

According to an embodiment of the present invention, in an omni-directional safety signature method supporting sequential combination, (a) selecting a j-th random value used for signing a j-th message (M _j ) at a current time point (t) Step to do; (b) generating a j-th signature for the j-th message (M _j ) using the _j- th random value and the t _j-th secret key for the j-th message (M _j ) at the current time point (t) step; (c) generating a jth integrated blind variable value using the jth random value and the integrated blind variable value up to a previous point in time; And (c) generating a combined signature by sequentially combining at least some of the signatures of the previous time points with the j-th signature, wherein the j-th integrated blind variable value is used for validity verification of the combined signature. An omni-directional safety signature method supporting the sequential combination as described may be provided.

The step (b) further comprises the step of deriving a backward security determination variable value (E _j ) using the maximum number of messages (n) and the index of the message (j), wherein when generating the jth signature, A result value c obtained by inputting the backward security determination variable value E _j and the j-th message M _j into a one-way hash function may be further used.

It may further include the step of verifying by determining whether the result of applying the backward security determination variable value E _j to the one-way hash function j times and information D included in the public key match.

The j-th random value may be calculated using the jth integrated blind variable value and the (j-1)th integrated blind variable value and used for verification of the combined signature.

The jth signature is generated by the following equation,

는 제j 랜덤값을 나타내고,

는 제t 시점의 비밀키를 나타내며, N은 랜덤하게 선택된 두 소수(prime)의 곱에 의해 생성된 합성수 그룹의 최대값이다. here,

Represents the jth random value,

Denotes the secret key at the t-th time point, and N is the maximum value of the composite number group generated by the product of two randomly selected primes.

In a computing device that performs an omnidirectional safety signature method supporting sequential combination, a j-th random value used for signing a j-th message (M _j ) of a current time point (t) is selected, and the j-th random value And a j-th signature for the j-th message (M _j ) by using the t _j-th secret key for the j-th message (M _j ) at the current time point (t), and transfers the j-th random value A signature generator for generating a jth integrated blind variable value using the integrated blind variable value up to the point in time; And a signature combiner for generating a combined signature by sequentially combining at least some of the signatures of previous points in time and the jth signature, wherein the jth integrated blind variable value is used for validity verification of the combined signature. A computing device may be provided.

The signature generation unit further calculates a backward security determination variable value (E _j ) using the maximum number of messages (n) and the index of the message (j), but the backward security determination variable value (E _j ) and the The result value (c) of inputting the j-th message M _j to the one-way hash function may be further used when generating the j-th signature.

A signature verification unit for verifying the jth signature by determining whether the backward security determination variable value (E _j ) is applied j times to the one-way hash function and information included in the public key (D) may be further included. have.

The signature verification unit may calculate the j-th random value using the j-th integrated blind variable value and the (j-1)-th integrated blind variable value, and use the j-th signature verification.

A combined signature verification unit for verifying the combined signature using the backward security determination variable value E _j , the j-th integrated blind variable value, and the (j-1)th integrated blind variable value may be further included.

A secret key update unit for updating the secret key using the t _j-th secret key may be further included, wherein the secret key update unit may be updated whenever a signature for a message is generated.

According to an embodiment of the present invention, by providing an omnidirectional safety signature method and apparatus supporting sequential combination, signatures generated at each time point can be sequentially combined.

In addition, the present invention can guarantee security for not only each signature but also a combined signature sequentially combined.

In addition, the present invention has the advantage of being able to verify the validity of signatures included in the combined signature through one verification of the combined signature.

In addition, the effects of the present invention are not limited to the above effects, and should be understood to include all effects that can be deduced from the configuration of the invention described in the detailed description or claims of the present invention.

1 is a diagram illustrating a conventional omnidirectional safety signature technique.
2 is a flow chart showing an omnidirectional safety signature method supporting sequential combination according to an embodiment of the present invention.
3 is a diagram showing a pseudo code for generating a signature according to an embodiment of the present invention.
4 is a diagram showing a pseudo code for generating a combined signature according to an embodiment of the present invention.
5 is a diagram showing a pseudo code for an initial key setting process according to an embodiment of the present invention.
6 is a diagram showing a pseudo code for generating a signature for an integrated blind variable according to an embodiment of the present invention.
7 is a diagram showing a pseudo code for verifying a signature according to an embodiment of the present invention.
8 is a diagram showing a pseudo code for verifying a combined signature according to an embodiment of the present invention.
9 is a diagram illustrating a pseudo code for verifying a signature for an integrated blind variable according to an embodiment of the present invention.
10 is a diagram showing a pseudo code for updating a secret key according to an embodiment of the present invention.
11 is a block diagram schematically illustrating an internal configuration of a computing device according to an embodiment of the present invention.

Singular expressions used in the present specification include plural expressions unless the context clearly indicates otherwise. In the present specification, terms such as “consisting of” or “comprising” should not be construed as necessarily including all of the various elements or various steps described in the specification, and some of the elements or some steps It may not be included, or it should be interpreted that it may further include additional elements or steps. In addition, terms such as "... unit" and "module" described in the specification mean units that process at least one function or operation, which may be implemented as hardware or software, or as a combination of hardware and software. .

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In order to facilitate understanding and description, the omnidirectional safety signature scheme, which is the basis of the present invention, will be briefly described first.

In the case of electronic signatures based on public and private keys (signature keys), if the private key (signature key) is exposed, there is no way to distinguish between a signature created previously by a legitimate signer and a signature forged by an attacker. The downside is that the signature must be invalidated.

In order to compensate for this, even if the secret key is exposed at a specific point in time, the electronic signature technique that allows the validity of the signatures before the secret key is exposed to be maintained is a forward safe signature technique.

As illustrated in FIG. 1, this forward-looking secure signature scheme may update the secret key when a signature is generated at a specific time point. In the case of the forward security signature scheme, the secret key can be updated so that it is impossible to infer the secret key of the past time by using the secret key of the current time. For this reason, even if the secret key at a specific time is exposed, there is an advantage in that the validity of the signature at the time before the exposure of the secret key can be maintained.

This omnidirectional secure signature technique basically includes a key setup process (setup), a signature generation process (Sig), a key update process (Upd), and a signature verification process (Ver). Each of these processes will be briefly described.

)를 출력한다. The key setup process (setup) receives the security parameters (k), the hash output length (l), the maximum number for the entire time period (T), and the maximum number of messages (n), and uses the public key (PK). And the initial secret key (

) Is displayed.

)을 출력한다. 여기서, 비밀키(SK_j)는 특정 시점(j)의 메시지 M을 서명하기 위한 비밀키이다. 이러한 서명 생성 과정(Sig)은 키 업데이트 과정(Udp)와 함께 반복적으로 수행될 수 있다. The signature generation process (Sig) uses the secret key (SK _j ) at a certain point in time (j) to sign the message M (

) Is displayed. Here, the secret key SK _j is a secret key for signing the message M at a specific point in time j. This signature generation process (Sig) may be repeatedly performed together with the key update process (Udp).

In the key update process (Upd), the secret key is updated and output. That is, the key update process (Upd) may be output by updating the secret key (SK _{j + 1)} of the next time (j + 1) using the secret key (SK _j) of the j point.

), 특정 시점(

), 특정 시점이 메시지(

)을 입력받은 후 검증 후보 서명(

)이 메시지(

)의 유효한 서명인지를 검증한다. 만일 유효한 서명인 경우 1(ture)을 출력하고, 유효한 서명이 아니면 0(false)을 출력한다. The signature verification process (Ver) is a process of verifying the signature. The signature verification process (Ver) is the public key (PK), the verification candidate signature (

), specific point in time (

), a message at a specific point in time (

) After receiving the verification candidate signature (

) This message (

) Is a valid signature. If it is a valid signature, 1(ture) is output, and if it is not a valid signature, 0(false) is outputted.

A basic omnidirectional safety signature technique has been described with reference to FIG. 1. Hereinafter, a description will be given of an omnidirectional safety signature method supporting sequential combination according to an embodiment of the present invention with reference to FIG. 2. The omnidirectional safety signature method supporting sequential combination described below has the same basic premise as the omnidirectional safety signature technique described in FIG. 1, and thus a detailed description of a known general omnidirectional safety signature technique will be omitted. Hereinafter, only portions necessary to explain the main thesis of the present invention will be described.

FIG. 2 is a flow chart showing an omnidirectional safety signature method supporting sequential combination according to an embodiment of the present invention, and FIG. 3 is a diagram showing a pseudo code for signature generation according to an embodiment of the present invention. 4 is a diagram showing a pseudo code for generating a combined signature according to an embodiment of the present invention, and FIG. 5 is a diagram showing a pseudo code for an initial key setting process according to an embodiment of the present invention, and FIG. 6 Is a diagram showing a pseudo code for generating a signature for an integrated blind variable according to an embodiment of the present invention, and FIG. 7 is a diagram showing a pseudo code for verifying a signature according to an embodiment of the present invention. 8 is a diagram showing a pseudo code for verifying a combined signature according to an embodiment of the present invention, and FIG. 9 is a diagram showing a pseudo code for verifying a signature for an integrated blind variable according to an embodiment of the present invention , FIG. 10 is a diagram showing a pseudo code for updating a secret key according to an embodiment of the present invention. Each of the following steps will be described on the assumption that they are performed by the computing device 200.

In step 210, the computing device 200 generates a j-th signature for the j-th message M _j by using the j-th private key of the current time point (referred to as a t-th time point for convenience). The pseudo code for this is shown in FIG. 3.

In operation 215, the computing device 200 sequentially combines the j-th signature from the j-th signature to generate a combined signature. A pseudo code for this is shown in FIG. 4.

According to an embodiment of the present invention, a single combined signature may be generated by sequentially combining the respective signatures generated at each time point by the omnidirectional safety signature. In addition, validity of the combined signatures can be verified by verifying the combined signature.

)이 서명 생성에 이용되는 해시 함수 입력으로 이용되었다. 즉, 서명은

와 같이 생성되었다. In the case of a conventional omnidirectional safety signature, the result value of exponentially multiplying the value of the periodicity-related variable to each random value used for each signature for validating each signature

) Was used as input to the hash function used to generate the signature. That is, the signature is

Was created as

가 이용됨에 따라 서명을 순차 결합하는 경우 서명의 유효성 검증에 이용되는 랜덤값을 특정할 수 있는 방법이 존재하지 않았다. For this reason, in the case of a conventional omnidirectional safety signature, when generating a signature,

As is used, when the signatures are sequentially combined, there is no method for specifying a random value used for validating signatures.

However, in an embodiment of the present invention, when generating each signature, by integrating all information on a random value verifying the validity of each signature into a specific variable (B), each random value used for generating each signature is Although not directly known, it is possible to calculate a random value for a specific time, through which the validity of the signature and combined signature can also be verified.

This will be described in detail.

)를 생성하기 위한 과정이다. 물론, 초기 키 설정 과정은 본 발명의 일 실시예에 따른 순차 결합을 지원하는 전방향 안전 서명 방법을 수행하기 위해 필요한 각각의 변수에 대한 초기값들을 설정할 수도 있음은 당연하다. First, the initial key setting process will be briefly described. The initial key setting process is a public key and an initial private key (

This is the process for creating ). Of course, it is natural that the initial key setting process may set initial values for each variable necessary to perform the forward safety signature method supporting sequential combination according to an embodiment of the present invention.

)를 생성할 수 있다. The pseudo code for the initial key setting process is as shown in FIG. 5. That is, in the initial key setting process, the security parameter (k), the hash output length (l), the maximum number for the entire time period (T), and the maximum number of messages (n) are respectively input, and the public key (PK ) And initial secret key (

) Can be created.

)을 생성할 수 있다. 본 발명의 일 실시예에서 변수 N은 합성수 그룹의 최대값인 것으로 이해되어야 할 것이다. In more detail, in the initial key setting process, a plurality of prime numbers (p', q') are randomly selected, and a composite number group (

) Can be created. It will be understood that the variable N in an embodiment of the present invention is the maximum value of the composite number group.

In addition, it should be understood that random values selected for an omnidirectional safety signature are selected within a corresponding composite number group, even if there is no separate description below.

)을 포함하고, 비밀키는

을 포함할 수 있다. In addition, the public key (PK) is a value (

), and the secret key is

It may include.

)내에서 랜덤하게 선택한다. 랜덤값(R_j)은 제t 시점(peroid)의 제j 메시지(M_j)의 유효성 검증에 이용될 수 있다. In addition, it is possible to set an initial value for each variable necessary to perform an omnidirectional safety signature supporting sequential combination. For this, reference will be made to the pseudo code shown in FIG. 5. After the initial key setting process as shown in FIG. 5 is completed, the computing device 200 adds the random value R _j to the composite number group (

) Is selected at random. The random value R _j may be used to verify the validity of the j th message M _j at the t _th peroid.

)을 계산한 후 해당 결과값을 메시지(M)과 함께 해시 함수 입력으로 이용하여 서명을 생성하였다. 즉,

와 같이, Y값이 서명 생성에 필요한 해시 함수 입력으로 입력되는 것을 알 수 있다. 이로 인해, 종래의 전방향 안전 서명 기법에 의해 각 주기마다 생성된 서명들을 결합하는 경우, 각 서명의 유효성 검증에 이용되는 랜덤값(R)이 뒤섞이게 되어 결합이 불가능한 문제점이 있었다. When creating a signature for a message using a secret key at a specific point in time, in the past, as already described above, the result value of the period variable value multiplied by the random value R _j

) Was calculated, and the result was used as an input of the hash function along with the message (M) to create a signature. In other words,

As shown, it can be seen that the Y value is input as the input of the hash function required for signature generation. For this reason, in the case of combining the signatures generated for each period by the conventional omnidirectional safety signature technique, there is a problem that the combination is impossible because the random values R used for validity verification of each signature are mixed.

In an embodiment of the present invention, in order to solve this problem, the integrated blind variable B is newly defined, and the product of the random value generated when each signature is generated may be updated to the integrated blind variable value.

For example, it is assumed that the j-th signature is combined in the i-th signature.

를 곱하여 결합 서명을 생성할 수 있다. In an embodiment of the present invention, a combined signature may be generated by sequentially multiplying the i-th signature to the j-th signature. That is, the computing device 200

By multiplying, we can create a combined signature.

을 통합하여 통합 블라인드 변수값을 계산한다. 본 발명의 일 실시예에서는

를 통합하기 위해

의

번째 근(root)에 대한 지식증명이 이용된다. In addition, when generating each signature, the computing device 200 is combined with each signature

By integrating, the integrated blind variable value is calculated. In one embodiment of the present invention

To integrate

of

Proof of knowledge for the second root is used.

According to an embodiment of the present invention, a signature (referred to as a blind signature) for the integrated blind variable may be generated to prove the validity of the integrated blind variable. A pseudo code for this may be as shown in FIG. .

To this end, in an embodiment of the present invention, a variable signature may be generated using an integrated blind variable (B _j ) and a deterministic variable (W _j ).

The pseudo code for this is as shown in FIG. 6.

In addition, in an embodiment of the present invention, a signature can be generated without a hash function when generating a signature, and security can be maintained. This will be described in more detail.

)를 계산할 수 있다. In addition, in an embodiment of the present invention, after defining the backward security determination variable (E), input the backward security determination variable (E) and a message into a one-way hash function, and the result value (

) Can be calculated.

The value of the backward security determination variable (E) is updated each time the signature is generated, and assuming that the message is the j-th message, it can be derived by applying a one-way hash function (n-j) times. Here, n may be the maximum number of messages.

가 계산되며, 이는 공개키에 포함될 수 있다. By applying a one-way hash function to the maximum number of messages (n) for the random value (C)

Is calculated, which can be included in the public key.

로 백워드 보안 확정 변수값(E_j)이 도출될 수 있다. Here, the value of the backward security determination variable E _j for the j-th message at time t may be derived by applying a hash function (nj) times. In other words,

The backward security determination variable value E _j can be derived.

인지 여부를 판단하여 t시점의 제j 메시지에 대한 유효성 검증은 백워드 보완 확정 변수값(E_j)의 유효성을 검증할 수 있다. In addition, the backward complementary confirmation validity of the value of the variable (E _j) can be easily verified by comparing whether or not the result of applying a backward complementary confirmation value of the variable (E _j) for j times a one-way hash function equal to D. In other words,

Whether or not, the validity of the jth message at time t may verify the validity of the backward complementation determination variable value E _j .

A signature for each message is generated by multiplying the secret key by exponentially multiplying the calculated result value (c) by inputting the value of the backward complement determination variable and the message into the one-way hash function.

와 같이 메시지에 대한 서명을 생성할 수 있다. In other words,

You can create a signature for a message like this:

는 제j 메시지에 대해 생성된 서명의 유효성 검증을 위해 이용되는 랜덤값이며,

는 제t 시점의 제j 메시지에 대한 서명을 위한 비밀키이다. 여기서, c는 백워드 보완 확정 변수값과 메시지를 단방향 해시 함수에 입력하여 계산된 결과값(c)이다. here,

Is a random value used for validating the signature generated for the jth message,

Is the secret key for signing the jth message at the tth time. Here, c is a result value (c) calculated by inputting a value of a backward complementation determination variable and a message into a one-way hash function.

As described above, when signing a message, a random value is used, but it can be seen that the exponential multiplied result value for the periodic part of the random value is not used as a hash function input as in the related art.

과 메시지(

)에 대한 검증을 위해,

인지 여부를 검증한다. 여기서,

이다. In order to facilitate understanding and explanation, a brief description will be given of how to verify a single message signature. signature

And message(

) For verification,

Whether it is or not. here,

to be.

이므로,

Because of,

이다.

to be.

A pseudo code for a detailed method of verifying a signature for a single message is shown in FIG. 7.

라고 가정하기로 한다. A combined signature that combines the signatures i through j

Let's assume.

에 의해 계산될 수 있다.

에 대한 결합 서명(

)은 다음과 같이 검증될 수 있다.

Can be calculated by

Combined signature for (

) Can be verified as follows.

이다. here,

to be.

The pseudo code for this is as shown in FIG. 8.

According to an embodiment of the present invention, the secret key is updated when a signature is generated due to the nature of an omnidirectional secure signature. The pseudo code for the private key update is as shown in FIG. 10.

11 is a block diagram schematically illustrating an internal configuration of a computing device according to an embodiment of the present invention.

Referring to FIG. 11, a computing device 200 according to an embodiment of the present invention includes an initialization unit 1110, a signature generation unit 1115, a blind signature generation unit 1120, an update unit 1125, and a verification unit ( 1130, a signature combination unit 1135, a combined signature verification unit 1140, a blind signature verification unit 1145, a memory 1150, and a processor 1155.

The initialization unit 1110 generates a public key and an initial secret key required for an omnidirectional secure signature method supporting sequential combination. Of course, the initialization unit 1110 may initialize various variables. The pseudo code for this is as shown in FIG. 5.

The signature generator 1115 generates a signature using the secret key for the jth message at the local time point.

A detailed description thereof is the same as that described in FIG. 2, and thus, a duplicate description will be omitted.

The blind signature generator 1120 generates a signature for the integrated blind variable value generated by the signature generator 1115. The pseudo code for this is as shown in FIG. 6.

The update unit 1125 updates the private key. That is, the updater 1125 may update the private key to be used for signing the next message by using the current private key. The pseudo code for this is as shown in FIG. 10.

The verification unit 1130 verifies the validity of the signature using the public key, signature, and message. The pseudo code for this is as shown in FIG. 7.

The signature combining unit 1135 generates a combined signature using a public key and a plurality of signatures to be combined. This is the same as that described in FIG. 2, so a duplicate description will be omitted. In addition, a pseudo code for this is as shown in FIG. 4.

The combined signature verification unit 1140 verifies the combined signature using a public key, a combined signature, and messages. This is the same as that described in FIG. 2, so a duplicate description will be omitted.

The blind signature verification unit 1145 verifies the blind signature for the integrated blind variable. The pseudo code for this is as shown in FIG. 9.

The memory 1150 is a means for storing various program codes (instructions) necessary to perform an omni-directional secure signature method supporting sequential combination.

The processor 1155 includes internal components of the computing device 200 according to an embodiment of the present invention (eg, an initialization unit 1110, a signature generation unit 1115, a blind signature generation unit 1120, and an update). It is a means for controlling the unit 1125, the verification unit 1130, the signature combination unit 1135, the combined signature verification unit 1140, the blind signature verification unit 1145, the memory 1150, and the like.

Further, the embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded in the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical, and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler but also high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as one or more software modules to perform the operation of the embodiments of the present invention, and vice versa.

As described above, in the present invention, specific matters such as specific components, etc., and limited embodiments and drawings have been described, but these are provided only to help the general understanding of the present invention, and the present invention is not limited to the above embodiments, Anyone of ordinary skill in the field to which the present invention belongs can make various modifications and variations from this description. Therefore, the spirit of the present invention is limited to the described embodiments and should not be defined, and all things that are equivalent or equivalent to the claims as well as the claims to be described later fall within the scope of the spirit of the present invention. .

Claims (13)

In the omnidirectional safety signature method supporting sequential combination,
(a) selecting a j-th random value used for signing the j-th message M _j at the current time point t;
(b) generating a j-th signature for the j-th message (M _j ) using the _j- th random value and the t _j-th secret key for the j-th message (M _j ) at the current time point (t) step;
(c) generating a jth integrated blind variable value using the jth random value and the integrated blind variable value up to a previous point in time; And
(c) generating a combined signature by sequentially combining at least some of the signatures of previous points and the j-th signature,
The jth integrated blind variable value is used to verify the validity of the combined signature.
The method of claim 1,
The step (b),
Further comprising the step of deriving a backward security determination variable value (E _j ) using the maximum number of messages (n) and the index of the message (j),
When generating the jth signature,
An omnidirectional safety signature supporting sequential combination, characterized in that the backward security determination variable value (E _j ) and the result value (c) of inputting the j-th message (M _j ) to a one-way hash function are further used Way.
The method of claim 2,
The result value (c) is an omnidirectional safety signature method that supports sequential combination, characterized in that calculated by the following equation.

The method of claim 2,
Before supporting sequential combination further comprising the step of verifying by determining whether the result of applying the backward security determination variable value (E _j ) to the one-way hash function j times and information included in the public key (D) Direction safety sign way.
The method of claim 2,
An omnidirectional safety signature supporting sequential combination, characterized in that the j-th random value is calculated using the j-th integrated blind variable value and the (j-1)th integrated blind variable value and used for verifying the combined signature Way.
The method of claim 2,
The j-th signature is generated by the following equation, characterized in that the forward safety signature method supporting sequential combination.

here,

Represents the jth random value,

Denotes the secret key at the t-th time point, and N is the maximum value of the composite number group generated by the product of two randomly selected primes.
A computer-readable recording medium product storing program codes for performing the method according to any one of claims 1 to 6.
In the omnidirectional safety signature method supporting sequential combination,
Select a j-th random value used for signature of the j-th message M _j at the current time point t, and the j-th random value and the j-th message M _j at the current time point t are selected. The jth signature is generated for the jth message (M _j ) using the t _j secret key, and the jth integrated blind variable value is generated using the jth random value and the integrated blind variable value up to the previous point in time. A signature generator; And
Including a signature combiner for generating a combined signature by sequentially combining at least some of the signatures of the previous time and the jth signature,
The computing device, wherein the j th integrated blind variable value is used to verify the validity of the combined signature.
The method of claim 8,
The signature generation unit,
The backward security determination variable value (E _j ) is further calculated using the maximum number of messages (n) and the index of the message (j),
And a result value (c) of inputting the backward security determination variable value (E _j ) and the j-th message (M _j ) to a one-way hash function is further used when generating the j-th signature.
The method of claim 9,
Computing further comprising a signature verification unit to verify the jth signature by determining whether the result of applying the backward security determination variable value (E _j ) to the one-way hash function j times and information included in the public key (D) Device.
The method of claim 10,
The signature verification unit,
And the j-th random value is calculated using the j-th integrated blind variable value and the (j-1)th integrated blind variable value and used for verifying the j-th signature.
The method of claim 10,
The computing device further comprises a combined signature verification unit for verifying the combined signature using the backward security determination variable value E _j , the j-th integrated blind variable value, and the (j-1)th integrated blind variable value.
The method of claim 8,
Further comprising a secret key update unit for updating the secret key by using the t _j secret key,
And the secret key update unit is updated each time a signature for a message is generated.

Images