Group signature system and method providing controllable linkability

A group signature method comprising:

• generating, by a key issuer server, a first parameter of a group public key, and generating a corresponding master issuing key;
• issuing a signature key to a user device when the user device joins;
• generating, by an opener server, a second parameter of the group public key, and a corresponding master opening key and master linking key;
• and
• checking, by a linker server, whether two valid signatures have been linked by using the master linking key when the two signatures are given.

A method for generating a group public key comprising:

• generating, by a key issuer server, a first parameter of a group public key and defining a corresponding master issuing key;
• defining, by an opener server, a master opening key and a master linking key, generating a second parameter of the group public key, and providing the generated second parameter to the key issuer server;
• and
• combining, by the key issuer server, the first and second parameters to generate the group public key.

A method for updating a group public key comprising:

• releasing, by a key issuer server, a revocation list for updating keys when a session is changed;
• generating, by the key issuer server, a new group public key and providing the new group public key to a user device;
• updating, by the user device, the group public key with the new group public key;
• and
• updating, by the user device, a signature key corresponding to the new group public key.

A method for generating a signature key comprising:

• receiving, at a key issuer server, a subscription request message from a user device;
• verifying, by the key issuer server, a validity of the subscription request message;
• receiving a signature with respect to the verified subscription request message from the user device;
• verifying, by the key issuer server, a validity of the signature to register the user device;
• and
• generating, by the user device, a secrete signature key corresponding to a group public key.

A method for encrypting a message:

• defining, by an opener server or a recipient, a public key, and storing a secret key corresponding thereto;
• outputting, by a message sender or a user device, a cryptogram regarding its message by using the public key;
• and
• calculating, by the opener server or the recipient, the cryptogram by using the secret key to recover the original message.