WO2018119670A1 - Method and device for certificateless partially blind signature - Google Patents

Abstract

The present invention belongs to the field of information security technology. A method for certificateless partially blind signature (CL-PBS), comprising: establishing a public system parameter params={G₁, G₂, P, e, g, H₀, H₁, H₂, P_pub}; a signer extracting (S_ID) as a private key and extracting (P) as a public key; the signer randomly selecting γ∈Z*_q, and calculating z=H₀(c) and R=rP, and transmitting R to a signature requester; having received R, the signature requester randomly selecting blinding factors α and β∈Z*_q, and calculating z=H₀(c), R'=αR, (y), h'=H₂(m, z, y), h=α^-1(β-h'), and transmitting h to the signer; having received h, the signer calculating (S), and transmitting S to the signature requester; the signature requester performing an unblinding operation, calculating S'=αS, and obtaining σ= (y, h', S') as a signature for a message m and a negotiation message c; and a verifier performing signature verification. The method effectively solves the security problem caused by the falsification of negotiation public information during the CL-PBS.

Description

Uncertified partial blind signature method and device Technical field

The invention belongs to the technical field of information security, and in particular relates to a method and device for blind signature of a certificateless part.

Background technique

A blind signature is a signature that the signer completes without knowing the content of the message requested by the signature requester. This feature is called blindness. The blind signature not only has the content integrity of the digital signature, the non-repudiation of the transaction and the authenticity of the identity of both parties, but also can protect the user's privacy by using blindness. In the blind signature, the signer knows nothing about the signed message, and it is easy to cause the signature to be illegally used by the malicious requester. Subsequently, the concept of a partial blind signature is proposed, which divides the message into a blinded part and a public part, so that part of the blind signature is controllable to the content of the signature while ensuring user privacy.

In an identity-based cryptosystem, the Key Generation Center (KGC) knows the private keys of all users and can spoof any user's signature. This problem is called key escrow. In order to solve this problem, in 2003 Al-Riyam and Paterson proposed the concept of Certificateless Public Key Cryptography (CL-PKC). For details, see Al-Riyami S S, Paterson K G. Certificateless Public Key Cryptography [J]. Lecture Notes in Computer Science, 2003, 2894 (2): 452-473. In CL-PKC, the key generation center generates a partial private key for the user, and the private key of the user is composed of a partial private key and a secret value randomly selected by itself, thereby solving the key escrow problem. The combination of certificateless public key cryptography and blind signature is called Certificateless Blind Signature (CL-BS). The use of CL-BS in e-commerce can protect the privacy of users and avoid PKI. Certificate management and key escrow issues in ID-PKC. In order to be better applied to the electronic cash system, certificateless public key cryptography and partial blind signature phase Combined with a Certificateless Partially Blind Signature (CL-PBS).

Existing literature on the publication of relevant uncertified partial blind signatures, such as:

Cheng L, Wen Q. Cryptanalysis and improvement of a certificateless partially blind signature [J]. IET Information Security, 2015, 9(6): 380-386.

Zhang L, Zhang F, Qin B, et al. Corrigendum: "Provably-secure electronic cash based on certicateless partially-blind signatures" [J]. Electronic Commerce Research & applications, 2011, 10(1): 545-552. Referred to as document 3.

Document 2 indicates that the CL-PBS scheme proposed in Document 3 cannot resist the attack of a malicious user replacing the signer's public key and proposes an improved scheme. However, through the analysis of the improvement plan, it is found that it cannot prevent malicious users from tampering with the negotiation of public information attacks.

Summary of the invention

The embodiment of the invention provides a certificateless partial blind signature method, which aims to solve the problem of low security of negotiating public information in the existing certificateless partial blind signature.

The embodiment of the present invention is implemented in this manner, and a method for blind signature of a certificateless portion includes:

Establish a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }; where l is a security parameter and satisfies the prime number q> 2 ^l , {G ₁ , +} is a cyclic addition group of order q, P is an arbitrary generator in group G ₁ ; {G ₂ , ·} is a cyclic multiplicative group of order q, g is a generator; bilinear pair mapping e :G ₁ ×G ₁ →G ₂ ,g=e(P,P)∈G ₂ ;hash function:

H ₁ :{0,1} ^* →G ₁ ,

KGC selects s as the primary key and P _pub =sP as the public key;

The signer extracts his private key as

Public key is

Signer randomly selected

And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

After the signature requester receives R, randomly selects the blinding factor

And calculate z=H ₀ (c), R'=αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

After the signer receives h, the calculation

And send S to the signature requester;

The signature requester performs the detachment work, calculates S'=αS, and obtains the signature of the message m and the negotiation message c as σ=(y, h', S');

The verifier performs signature verification.

Preferably, the specific steps of establishing a public system parameter params={G ₁ , G ₂ , P, l, q, e, H ₁ , H ₂ , H ₃ , P _pub } are:

According to the security needs, determine the size of the safety factor l and the prime number q, and construct the cyclic addition group {G ₁ , +} and the cyclic multiplication group {G ₂ satisfying the bilinear mapping e: G ₁ × G ₁ → G ₂ by using the elliptic curve. ,·};

Select collision-free hash function

H ₁ :{0,1} ^* →G ₁ ,

An integer s is randomly selected from the integer multiplication group of mod q as the master key of the private key generation center KGC, and P _pub =sP is calculated as its corresponding public key;

The system parameters {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub } are disclosed and s is stored as the master key value.

Preferably, the signer extracts its private key as

Public key is

The specific steps are:

Enter the system parameter params, the signer's identity ID _B , KGC calculation

Partial private key

Sent to the signer;

According to the system parameter params and the signer's identity ID _B , the signer randomly chooses

As its secret value;

According to the system parameter params, the signer's identity ID _B , part of the private key

And secret value

Get the signer's private key as

According to the system parameter params, the signer's identity ID _B and the secret value

Get the signer's public key

Preferably, the specific steps of the verifier to perform signature verification include:

The verifier receives the message-signature pair of the signer (m, c, σ = (y, h', S'));

Calculate z=H ₀ (c),

Verify that the equality h'=H ₂ (m,z,y') holds, and if so, the verifier believes that (m,c,σ=(y,h',S')) is valid by the signer Blind signature

Otherwise invalid.

An embodiment of the present invention further provides a certificateless partial blind signature device, including:

a system parameter establishing unit for establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

An extracting unit, configured for the signer to extract the private key and the public key;

Commitment unit for random selection

And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

Blind unit for randomly selecting the blinding factor after receiving R

And calculate z=H ₀ (c), R'=αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

Partial blind signature unit, used to receive h after calculation

And send S to the signature requester;

a detachment unit for performing detachment work, calculating S'=αS, obtaining a signature of the message m and the negotiation message c as σ=(y, h', S');

A verification unit for signature verification.

Preferably, the system parameter establishing unit comprises:

Constructing a module for determining the size of the safety factor l and the prime number q, constructing a cyclic addition group {G ₁ , +} and a cyclic multiplication group {G satisfying the bilinear map e: G ₁ × G ₁ → G ₂ using an elliptic curve ₂ ,·};

Function selection module for selecting collision-free hash functions

H ₁ :{0,1} ^* →G ₁ ,

a key module for randomly selecting an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculating P _pub =sP as its corresponding public key, and exposing the system parameter {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }, and save s as the master key value.

Preferably, the extracting unit comprises:

Partial private key generation module for calculating according to the system parameter params, the signer's identity ID _B , KGC

Partial private key

Sent to the signer;

a secret value generating module for randomly selecting according to the system parameter params and the signer's identity ID _B

As its secret value;

Private key module, used according to system parameter params, signer's identity ID _B , partial private key

And secret value

Get the signer's private key as

Public key module for identifying the system parameter params, the signer's identity ID _B, and the secret value

Get the signer's public key

Preferably, the verification unit comprises:

a receiving module, configured to receive a message-signature pair (m, c, σ=(y, h', S')) sent by the signature requester;

a calculation module for calculating z=H ₀ (c),

a verification module for verifying whether the equation h'=H ₂ (m, z, y') holds, and if so, the verifier believes that (m, c, σ = (y, h', S')) is The signer performs a valid blind signature, otherwise it is invalid.

The technical solution of the present invention, since the signer inserts the negotiation information into the calculation

Where z=H ₀ (c), by proving the correctness of the signature scheme, the signer inserts the negotiation information z=H ₀ (c) not only corresponds to the negotiation information of the signature requester C for blind signature insertion

Also negotiates the insertion negotiation information used in the verification equation.

Correspondingly, therefore, the solution of the present invention is safe under the negotiation information tampering attack, and effectively solves the security problem caused by tampering with the public information in the certificateless partial blind signature.

DRAWINGS

FIG. 1 is a schematic flowchart of a method for blind signature of a certificateless portion according to an embodiment of the present invention;

2 is a schematic flow chart of a method for blind signature of a certificateless portion according to an embodiment of the present invention;

3 is a structural block diagram of a certificateless partial blind signature device according to an embodiment of the present invention;

4 is a structural block diagram of a system parameter establishing unit of the present invention;

Figure 5 is a block diagram showing the structure of an extracting unit of the present invention;

Figure 6 is a block diagram showing the structure of a verification unit of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In order to more effectively understand the technical solution of the present invention, we briefly describe the process of partial blind signature in the above document 2:

First, establish a public system parameter params={G ₁ , G ₂ , P, l, q, e, H ₀ , H ₁ , H ₂ , P _pub }.

Given the security parameter l, and satisfying the prime number q>2 ^l , {G ₁ , +} is a cyclic addition group of order q, P is any generator in group G ₁ ; {G ₂ ,·} is the order q The cyclic multiplication group, g is the generator; the bilinear pair map e: G ₁ × G ₁ → G ₂ , g = e(P, P) ∈ G ₂ ; hash function:

KGC selects s as the primary key, P _pub =sP as the public key, and the system parameters params={G ₁ , G ₂ , P, l, q, e, H ₀ , H ₁ , H ₂ , P _pub }.

Then perform the key extraction algorithm:

Partial private key generation algorithm: input system parameter params, signer's identity ID _B , KGC calculation

Partial private key

Sent to the signer.

Set the secret value algorithm: enter the system parameter params and the signer's identity ID _B , the signer randomly chooses As its secret value.

Set the private key algorithm: algorithm input system parameters, signer's identity ID _B , partial private key

And secret value

The private key of the output signer is

Set the public key algorithm: algorithm input system parameters, signer's identity ID _B and secret value

Enter the signer's public key

Then part of the blind signature generation algorithm:

Suppose m is the information that the signature requester requests to sign, c is the public information that the signer negotiates with the signing requester, and the signer uses its private key.

And public key

The message m and the public consultation information c are signed with the signature requester. The specific process is as follows:

a) Commitment. Signer randomly selected

And calculate z = H ₀ (c) and R = rzP, and send R to the signature requester.

b) Blind. After the signature requester receives R, randomly selects the blinding factor

And calculate z = H ₀ (c), R' = γR,

h = γ ^-1 (β-h') and send h to the signer.

c) Partial blind signature. After accepting h, the signer only needs to calculate

And send S to the signature requester.

d) literacy. The signature requester calculates S' = γS + αP _pub .

After this series of interactions, the signature requester obtains the signature of the message m and the negotiation information c as σ=(R', h', S').

Finally, the signature verification algorithm is performed:

The verifier receives the signature by the signer message negotiation information c and m is σ = (R ', h' , S '), the first calculation z = H ₀ (c),

Final verification equation

Whether it is established. If so, the message-signature pair (m, c, σ = (R', h', S')) is considered to be the signature of the signer. Otherwise invalid.

The above scenarios will generate security attacks. The specific attacks are analyzed as follows:

Because the scheme is to change the negotiation information c篡 to c' attack, the signer uses its private key.

And public key

The message requester and the public negotiation information c are signed with the signature requester, and the signature requester changes the negotiation information c to c':

a) Commitment. Signer randomly selected

And calculate z = H ₀ (c) and R = rzP, and send R to the signature requester.

b) Blind. After the signature requester receives R, randomly selects the blinding factor

Calculate z = H ₀ (c), z' = H ₀ (c'), R' = γR, R" = z ^-1 z'R',

h = γ ^-1 (β-h') and h" = zz' ^{- 1} h, and send h" to the signer.

c) Partial blind signature. After accepting h′′, the signer only needs to calculate

And send S to the signature requester.

d) literacy. The signature requester calculates S'=z ^-1 z'S, S" = γS' + αP _pub .

After this series of interactions, the signature requester obtains the signature of the message m and the negotiation information c' as σ = (R", h', S").

The signature of the signature requester to the message m and the negotiation information c' is σ=(R′′, h′, S′′), which needs to be calculated.

z'=H ₀ (c') verification equation

Whether it is established. If it is established, it is a valid signature, that is, the tampering negotiation information c' is successful. In this verification process, you only need to verify the equation.

Whether it is established;

That is, without the consent of the signer, the signature formed by the signature requester after tampering with the public information can also be verified by the verification equation, so the verifier believes that σ=(R′′,h′,S′′) is the signer pair. The valid signature of message m and negotiation message c'.

As shown in FIG. 1 and FIG. 2, an embodiment of the present invention provides a certificateless partial blind signature method, including the following steps:

Step S100, establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

Where l is a security parameter and satisfies the prime number q>2 ^l , {G ₁ , +} is a cyclic addition group of order q, P is any generator in group G ₁ ; {G ₂ ,·} is the order The cyclic multiplicative group of q, g is the generator; the bilinear pair map e:G ₁ ×G ₁ →G ₂ ,g=e(P,P)∈G ₂ ;hash function:

H ₁ :{0,1} ^* →G ₁ ,

KGC selects s as the primary key and P _pub =sP as the public key;

Step S200, the signer extracts its private key as

Public key is

Step S300, the signer randomly selects

And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

Step S400, after the signature requester receives the R, randomly selects the blinding factor.

And calculate z = H ₀ (c), R' = αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

Step S500, after the signer receives the h, the calculation is performed.

And send S to the signature requester;

Step S600, the signature requester performs the detachment work, calculates S'=αS, and obtains the signature of the message m and the negotiation message c as σ=(y, h', S');

In step S700, the verifier performs signature verification.

Preferably, in the step S100, the specific steps of establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub } are:

Step S110, determining the size of the safety factor l and the prime number q according to the safety requirement, and constructing the cyclic addition group {G ₁ , +} and the cyclic multiplication group satisfying the bilinear mapping e: G ₁ × G ₁ → G ₂ by using an elliptic curve. {G ₂ ,·};

Step S120, selecting a collision-free hash function H ₁ : {0, 1} ^* → G ₁ ,

Step S130, randomly selecting an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculating P _pub =sP as its corresponding public key;

In step S140, the system parameters {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub } are disclosed, and s is saved as the master key value.

Further, the step S200 specifically includes:

Step S210, input system parameter params, signer's identity ID _B , KGC calculation

Partial private key

Sent to the signer;

Step S220, according to the system parameter params and the identity ID _B of the signer, the signer randomly selects

As its secret value;

Step S230, according to the system parameter params, the signer's identity ID _B , part of the private key

And secret value

Get the signer's private key as

Step S240, according to the system parameter params, the signer's identity ID _B and the secret value

Get the signer's public key

Further, in the step S700, the method specifically includes:

Step S710, the verifier receives the message-signature pair of the signer (m, c, σ = (y, h', S'));

Step S720, calculating z=H ₀ (c),

Step S730, verifying whether the equation h'=H ₂ (m, z, y') holds, and if so, the verifier believes that (m, c, σ = (y, h', S')) is the signer Conduct effective blind signatures;

Otherwise invalid.

Because the signer inserts the negotiation information into the calculation

Where z=H ₀ (c), by proving the correctness of the signature scheme, it is found that the signer inserts the negotiation information z=H ₀ (c) not only corresponds to the negotiation information of the signature requester for blind signature insertion.

Also negotiates the insertion negotiation information used in the verification equation.

Corresponding. Therefore, this program can prevent public consultation information from tampering attacks.

As shown in FIG. 3, an embodiment of the present invention further provides a certificateless partial blind signature device, including:

a system parameter establishing unit 100, configured to establish a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

The extracting unit 200 is configured to extract a private key and a public key by the signer;

Commitment unit 300 for random selection

And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

The blinding unit 400 is configured to randomly select a blinding factor after receiving the R

And calculate z=H ₀ (c), R'=αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

Partial blind signature unit 500, configured to receive h after calculation

And send S to the signature requester;

The detachment unit 600 is configured to perform detachment work, calculate S'=αS, and obtain the signature of the message m and the negotiation message c as σ=(y, h', S');

The verification unit 700 is configured to perform signature verification.

As shown in FIG. 4, the system parameter establishing unit 100 further includes:

The construction module 101 is configured to determine the size of the safety factor l and the prime number q, and construct the cyclic addition group {G ₁ , +} and the cyclic multiplication group satisfying the bilinear mapping e: G ₁ × G ₁ → G ₂ by using an elliptic curve { G ₂ ,·};

Function selection module 102 for selecting a collision-free hash function

H ₁ :{0,1} ^* →G ₁ ,

The key module 103 is configured to randomly select an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, calculate P _pub =sP as its corresponding public key, and disclose the system parameter {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }, and s is stored as the master key value.

As shown in FIG. 5, the extracting unit 200 further includes:

Partial private key generation module 201, according to the system parameters params, the signer's identity ID _B, KGC calculated

Partial private key

Sent to the signer;

The secret value generating module 202 is configured to randomly select according to the system parameter params and the identity ID _{B of the} signer.

As its secret value;

The private key module 203 is configured to use a system parameter params, a signer's identity ID _B , and a partial private key.

And secret value

Get the signer's private key as

Public key module 204 for using system parameter params, signer's identity ID _B, and secret value

Get the signer's public key

As shown in FIG. 6, the verification unit 700 further includes:

The receiving module 701 is configured to receive a message-signature pair (m, c, σ=(y, h', S')) sent by the signature requester;

a calculation module 702, configured to calculate z=H ₀ (c),

The verification module 702 is configured to verify whether the equation h'=H ₂ (m, z, y') is established, and if so, the verifier believes that (m, c, σ = (y, h', S')) is A valid blind signature is performed by the signer, otherwise it is invalid.

In the following, the technical solution in the present invention is compared with the above-mentioned existing CL-PBS scheme, including the schemes in the literature 2 and the document 3, wherein the document 2 is an improvement on the public key replacement attack in the document 3. Program. A super-singular elliptic curve E(F _P ) with an embedding degree of 2 is used: y ² = x ³ + x, where q = 2 ¹⁵⁹ + 2 ¹⁷ +1 is a 160-bit prime number, and p is 512 satisfying the condition p+1 = 12qr Bit number. Hardware platform: CPU is CPIV 3-GHZ, 512MB memory and Windows XP operating system. Table 1 lists the time-consuming basic unit operation efficiencies in the cryptographic scheme.

Table 1 Basic unit operation efficiency in the scheme (in milliseconds)

Table 2 lists the number of calculations for specific time-consuming operations in each scenario, mainly comparing the amount of calculations by the signer, signature requester, and verifier during the scenario construction process.

Table 2 Comparison of calculation performance of various schemes (unit: millisecond)

In summary, it can be clearly seen that the solution constructed by the present invention has higher efficiency.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims (8)

1. A certificateless partial blind signature method, comprising:

   Establish a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }; where l is a security parameter and satisfies the prime number q> 2 ^l , {G ₁ , +} is a cyclic addition group of order q, P is an arbitrary generator in group G ₁ ; {G ₂ , ·} is a cyclic multiplicative group of order q, g is a generator; bilinear pair mapping e :G ₁ ×G ₁ →G ₂ ,g=e{P,P)∈G ₂ ;hash function:

   

   H ₁ :{0,1} ^* →G ₁ ,

   

   KGC selects s as the primary key and P _pub =sP as the public key;

   The signer extracts his private key as

   

   Public key is

   

   Signer randomly selected

   

   And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

   After the signature requester receives R, randomly selects the blinding factor

   

   And calculate z=H ₀ (c), R'=αR,

   

   h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

   After the signer receives h, the calculation

   

   And send S to the signature requester;

   The signature requester performs the detachment work, calculates S'=αS, and obtains the signature of the message m and the negotiation message c as σ=(y, h', S');

   The verifier performs signature verification.
2. The uncertified partial blind signature method according to claim 1, wherein said establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P The specific steps of _pub } are:

   According to the security needs, determine the size of the safety factor l and the prime number q, and construct the cyclic addition group {G ₁ , +} and the cyclic multiplication group {G ₂ satisfying the bilinear mapping e: G ₁ × G ₁ → G ₂ by using the elliptic curve. ,·};

   Select collision-free hash function

   

   H ₁ :{0,1} ^* →G ₁ ,

   

   An integer s is randomly selected from the integer multiplication group of mod q as the master key of the private key generation center KGC, and P _pub =sP is calculated as its corresponding public key;

   The system parameters {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub } are disclosed and s is stored as the master key value.
3. The certificateless partial blind signature method according to claim 1, wherein said signer extracts his private key as

   

   Public key is

   

   The specific steps are:

   Enter the system parameter params, the signer's identity ID _B , KGC calculation

   

   Partial private key

   

   Sent to the signer;

   The system parameters params and the identity of the signer ID _B, the signer randomly selected

   

   As its secret value;

   According to the system parameter params, the signer's identity ID _B , part of the private key

   

   And secret value

   

   Get the signer's private key as

   

   According to the system parameter params, the signer's identity ID _B and the secret value

   

   Get the signer's public key

   
4. The certificateless partial blind signature method according to claim 1, wherein the specific step of the verifier performing signature verification comprises:

   The verifier receives the message-signature pair of the signer (m, c, σ = (y, h', S'));

   Calculate z=H ₀ (c),

   

   Verify that the equality h'=H ₂ (m,z,y') holds, and if so, the verifier believes that (m,c,σ=(y,h',S')) is valid by the signer Blind signature

   Otherwise invalid.
5. A certificateless partial blind signature device, comprising:

   a system parameter establishing unit for establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

   An extracting unit, configured for the signer to extract the private key and the public key;

   Commitment unit for random selection

   

   And calculate z = H ₀ (c) and R = rP, and send R to the signature requester;

   Blind unit for randomly selecting the blinding factor after receiving R

   

   And calculate z=H ₀ (c), R'=αR,

   

   h' = H ₂ (m, z, y), h = α ^-1 (β-h'), and send h to the signer;

   Partial blind signature unit, used to receive h after calculation

   

   And send S to the signature requester;

   a detachment unit for performing detachment work, calculating S'=αS, obtaining a signature of the message m and the negotiation message c as σ=(y, h', S');

   A verification unit for signature verification.
6. The certificateless partial blind signature device according to claim 5, wherein the system parameter establishing unit comprises:

   Constructing a module for determining the size of the safety factor l and the prime number q, constructing a cyclic addition group {G ₁ , +} and a cyclic multiplication group {G satisfying the bilinear map e: G ₁ × G ₁ → G ₂ using an elliptic curve ₂ ,·};

   Function selection module for selecting collision-free hash functions

   

   H ₁ :{0,1} ^* →G ₁ ,

   

   a key module for randomly selecting an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGG, and calculating P _pub =sP as its corresponding public key, and exposing the system parameter {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }, and save s as the master key value.
7. The certificateless partial blind signature device according to claim 5, wherein the extracting unit comprises:

   Part of the private key generation module for calculating according to the system parameter params, the signer's identity ID _B , KGG

   

   Partial private key

   

   Sent to the signer;

   a secret value generating module for randomly selecting according to the system parameter params and the signer's identity ID _B

   

   As its secret value;

   Private key module, used according to system parameter params, signer's identity ID _B , partial private key

   

   And secret value

   

   Get the signer's private key as

   

   The public key module, ID _B for identity and a secret value based on system parameters params, the signer

   

   Get the signer's public key

   
8. The certificateless partial blind signature device according to claim 5, wherein the verification unit comprises:

   a receiving module, configured to receive a message-signature pair (m, c, σ=(y, h', S')) sent by the signature requester;

   a calculation module for calculating z=H ₀ (c),

   

   a verification module for verifying whether the equation h'=H ₂ (m, z, y') holds, and if so, the verifier believes that (m, c, σ = (y, h', S')) is The signer performs a valid blind signature, otherwise it is invalid.

Images