A Rational Threshold Signature Model and Protocol Based on Different Permissions

Abstract

This paper develops a novel model and protocol used in some specific scenarios, in which the participants of multiple groups with different permissions can finish the signature together. We apply the secret sharing scheme based on difference equation to the private key distribution phase and secret reconstruction phrase of our threshold signature scheme. In addition, our scheme can achieve the signature success because of the punishment strategy of the repeated rational secret sharing. Besides, the bit commitment and verification method used to detect players’ cheating behavior acts as a contributing factor to prevent the internal fraud. Using bit commitments, verifiable parameters, and time sequences, this paper constructs a dynamic game model, which has the features of threshold signature management with different permissions, cheat proof, and forward security.

1. Introduction

Secret sharing (SS) scheme, first proposed by Shamir [1] in the paper “How to share a secret,” is a significant method used for the important information management. There are other SS schemes presented by Blakeley [2] and Asmuth and Bloom [3]. These (𝑡,𝑛)-threshold schemes above split the secret to 𝑛  shares and distribute these shares to 𝑛  legal players, meaning that all the players in the secret sharing system have the same permissions. However, in some specific situations, like in a company, managers and employees are supposed to have different authority in the confidential secret management. As a result, all the SS schemes are not suitable to be applied to such scenario. Later, many scholars devoted themselves to the weighted threshold SS schemes, which can solve the above problem. Shamir was concerned with weighted threshold SS in his paper “How to share a secret”—the president of a company has three shares, the vice presidents have two shares, and others have one share. Later, Morillo et al. [4] developed some main properties related to the information ratio, which measures a secret sharing system’s security. After that, many researchers used their work to develop weight SS schemes, and some are with bipartite [5–7]. Chan and Chang [8] developed a new (𝑡,𝑛)-threshold scheme based on differential equations, which was completely different from the mechanism of weighted SS scheme and shared the same notion with Li [9]. Instead of the traditional weighted threshold SS schemes, which have the symmetrical permissions limitation, they proposed (𝑡₁+𝑡₂,𝑛₁+𝑛₂)-threshold SS scheme that is based on homogeneous constant coefficient linear difference equation. In the scheme, all players are divided into two groups (denoted by 𝐴, 𝐵) with the different secret management authority; just 𝑡₁ players from 𝐴 and 𝑡₂ players from 𝐵 can recover the original secret information. For example, a company divides its business secret into (𝑛₁+𝑛₂) shares, in which 𝑛₁ shares are possessed by 𝑛₁ specific employees and 𝑛₂ shares are distributed to 𝑛₂ managers. Any 𝑡₁ employees and 𝑡₂ managers can retrieve the business secret.

Threshold signature is based on SS, which was first proposed by Desmedt and Frankel [10] and based on RSA signature mechanism. Shamir [11] introduced the concept of signature authentication based on identity. Paterson and Schuldt [12] presented efficient identity-based signatures in the standard model. In this paper, to illustrate our model, we adopt Okamoto’s signature method [13], which is based on the identification scheme and is provably secure.

Another important issue about the traditional SS scheme is that they are all based on the assumption that every player is either honest or malicious. However, in practice, players are more likely to be selfish, trying to maximize their own utility. Halpern and Teague [14] introduced the notion of rational secret sharing (RSS) in 2004 and presented a randomized protocol for a 𝑡≥3,𝑛>3 SS scheme, which can achieve Nash equilibrium after repeated elimination of weakly dominated strategy. Gordon and Katz [15] improved Halpern’s protocol to 𝑡≥2,𝑛>2 conditions. The mechanism proposed by Maleka et al. [16] is called repeated rational secret sharing (RRSS), in which the distributor needs to do second-time segmentation of the secret shares and made the players share the subshares repeatedly. Maleka’s method uses punishment strategies to prevent players from finking, which is different from Halpern and Teague’s RSS protocol, in which some rounds of secret sharing are meaningless.

In this paper, we present a rational threshold signature model, in which the participants are divided into two sets with the different permissions. We adopt the SS scheme based on the difference equations to distribute shares and recover the original secrets. In the recover phrase, players exchange their subshares repeatedly based on Maleka’s RRSS scheme. In our model, we use several modules to manage the functions, respectively. The parameter sequence generator is used to generate the parameters of the difference equations and parameter distributor is used to distribute the parameters to the participants as their shares. Rounds controller is used to generate the random number of rounds so that the players cannot know when the repeated games will end. Bit commitment module is utilized for the players to commit their own subshares and verify others’. Besides, when a player cheats in a specific round by sending the wrong subshare, the verifiable module can detect it and the protocol will be stopped so that nobody can acquire the secret.

2. Relative Works

2.1. The Model of Li Bin Scholar

The model is outlined as follows.

Maker constructs homogeneous constant coefficient linear differential equation: 𝑎_𝑛+^𝑡1_𝑖=1𝑏_𝑖𝑎_𝑛−𝑖=0𝑏_𝑖∈𝑍_𝑞, (1) Master key: 𝑘=𝑎_𝑁(𝑁>𝑛₁), Shadow keys of participants in set 𝐴 are (𝑎_𝑖,𝑏₁)(𝑖=0,1,…,𝑛₁−1), Shadow keys of participants in set 𝐵 are (𝑁,𝑏₂,…,𝑏_𝑡1).

The general term formula of homogeneous constant coefficient linear differential equation is 𝑎_𝑛=^𝑡1_𝑖=1𝑐_𝑖𝑓_𝑖(𝑛). (2)

Because coefficient determinant is nondegenerate second-order tensor, Δ_𝑡×𝑡=𝑓₁(0)𝑓₂(0)⋯𝑓_𝑡𝑓(0)₁(1)𝑓₂(1)⋯𝑓_𝑡𝑓(1)⋮⋮⋱⋮₁(𝑡−1)𝑓₂(𝑡−1)⋯𝑓_𝑡(𝑡−1)_𝑡×𝑡≠0. (3) Participants in set 𝐴 calculate constant vector: 𝑐=𝑐₁,𝑐₂,…,𝑐_𝑡1^𝑇. (4)

Any participant in set 𝐵 makes 𝑛=𝑁 can obtain the system master key: 𝑎_𝑁=^𝑡1_𝑖=1𝑐_𝑖𝑓_𝑖(𝑁)𝑁>𝑛₁. (5)

2.2. Problems

The model mentioned above is a big innovation in the field of threshold structure; however, if applied directly to the threshold signature, while in practical use, some problems may exist as follows.(1)The permissions in this model have limitations. The second component of (𝑛₁+𝑛₂,𝑡₁+1)-threshold shared structure on behalf of the second category participants with special privileges; these participants have excessive permissions, because anyone of them can represent the group. Thus, weexpand the second component into (𝑛₁+𝑛₂,𝑡₁+𝑡₂) structure. Wei et al.’s scholars [17, 18] at Shandong University have proposed the definition of such structure. However, when this scheme is implemented, its two groups both use the polynomial ring, which possesses the symmetrical nature, thus it will break the different privileges characteristic of the homogeneousconstant coefficient linear differential equation. This paper promotes (𝑛₁+𝑛₂,𝑡₁+1) structure based on homogeneous constant coefficient linear differential equation, extends permissions, in the meantime, and improves the original proposal.(2)This model cannot resist conspiracy attacks, because of that when greater than or equal to the (𝑡₁,0) threshold number of participants work out the constant vector group of equation (4), at the same time, the equation (2) is determined. Conspires can get the the private key of the participants of the first set, using the general term formula, and one copy of the private key of the second set’s participant can be used to conjecture the others’ private keys in the second set.(3)The model cannot resist internal fraud. When put into practical use, the model does not have a verifiable, and the participants’ fraud is undetectable. If there are no validation measures, the participants may run this protocol arbitrarily, or send their false shares, and these cannot be tolerated.(4)The model has the dealer, who is the trusted third party. In the distributed network environment, the parameters is generated by a machine or by the secure multiparty computation.(5)This model does not have the rational characteristics. When the signature private keys are generated, and when the first set’s participants compute the equation (2)—after computing the general term formula, the participants in the second set have no motive to expose their private key to the participants in the first set, after they generate their private keys. This loses fairness.

3. Protocol Model

3.1. The Structure of Model

The structure of the model is shown in Figure 1.

Figure 1 

The structure diagram of model.

(1) Parameter Sequence Generator. Each time while in the signature step, the registers in parameters sequence generator dynamically generate the next state parameters according to the last state parameters. Each signature call the module once; the use of time series technology makes the model have forward security.

The initial vector in parameter sequence generator is 𝑎^𝑇0=𝑎^𝑇0_𝑛,𝑎^𝑇0_𝑛−1,…,𝑎^𝑇0_𝑛−𝑡1^𝑇,𝑏^𝑇0=𝑏^𝑇0₁,𝑏^𝑇0₂,…,𝑏^𝑇0_𝑡1^𝑇. (6)

The iterative formulas of parameter sequence generator are as follows: 𝑎^𝑇𝑖+1=𝑎^𝜌𝑇𝑖_𝑛,𝑎^𝜌𝑇𝑖_𝑛−1,…,𝑎^𝜌𝑇𝑖_𝑛−𝑡1^𝑇mod𝑞𝑖≥0∧𝑖∈𝑍⁺,𝜌∈_𝑅𝐺𝐹𝑞^∗,𝑏^𝑇𝑖+1=𝑏^𝜌𝑇𝑖₁,𝑏^𝜌𝑇𝑖₂,…,𝑏^𝜌𝑇𝑖_𝑡1^𝑇mod𝑞𝑖≥0∧𝑖∈𝑍⁺,𝜌∈_𝑅𝐺𝐹𝑞^∗. (7)

Other parameters are generated like this way.

Theorem 1. The model has forward security.

Proof. On the completion of the last signature, in next signature step, the parameter sequence generator precompiled the iteration values in registers. After iteration, according to recurrence relations (7), the last data in registers will not exist. That is to say, this time’s signature data in registers will cover the last data in them. According to the recurrence relations (7), if an attacker wants to get last data in registers, he or she must calculate mode square root: 𝑎^𝑇𝑖_𝑘=^𝜌𝑎^𝑇𝑖+1_𝑘mod𝑞,𝑖≥0∧𝑖∈𝑍⁺,𝑘=𝑛,…,𝑛−𝑡₁∧𝜌∈_𝑅𝐺𝐹𝑞^∗,𝑏^𝑇𝑖_𝑘=^𝜌𝑏^𝑇𝑖+1_𝑘mod𝑞,𝑖≥0∧𝑖∈𝑍⁺,𝑘=1,…,𝑡₁∧𝜌∈_𝑅𝐺𝐹𝑞^∗. (8)
The mode square root in polynomial time is computationally infeasible, and the mode indices are random; attacker cannot predict. So the model has forward security.

(2) Rounds Controller. This model, which runs multiple rounds in the signature process, is a limited time repetitions dynamic game. It is vital in the model and controls the operation of the entire process. Here we use the idea of stochastic process [19] to construct model.

Theorem 2. The distribution of round obeys Poisson distribution with parameter 𝜆.

Proof. In the condition of time limited game process, note that the number of deceptions in each round is 𝑘, with the probability satisfying the following formula: Pr_𝑘𝑟₀,𝑟=Pr𝑁𝑟₀,𝑟=𝑘(𝑘∈𝑍). (9) Participants’ behavior is independent in each round.
Assuming the number of rounds has continuity, that is to say, the process of game is taken as continuous function with time, Pr₁(){𝑁()}(),𝑟,𝑟+Δ𝑟=Pr𝑟,𝑟+Δ𝑟=1=𝜆Δ𝑟+𝑜Δ𝑟)(𝜆>0∧∀Δ𝑟⟶0_∞𝑖=2Pr_𝑖(𝑟,𝑟+Δ𝑟)=^∞_𝑖=2{𝑁()}(),Pr𝑟,𝑟+Δ𝑟=𝑖=𝑜Δ𝑟)(𝜆>0∧∀Δ𝑟⟶0 (10) and it satisfies that 𝑁(0)=0+𝑜(𝜀). (11)

This means that, the probability of cracking the system with 𝜀 computational advantages can be negligible, when the threshold signature process is not performed. The model satisfies the four conditions mentioned above and meets the definition of Poisson process with 𝜆 intensity. That is, 𝑁(𝑟)−𝑁𝑟₀∼𝜋𝜆𝑟−𝑟₀. (12)

Theorem 3. The expectations rounds of this model are 𝜆, each time the model convergence time complexity is 𝑂(𝜆).

Proof. Differential equations are established for the rounds (𝑟₀,𝑟₁,…,𝑟^∗) respectively, based on the four conditions mentioned abovePr_𝑘𝑟₀,𝑟=Pr𝑁𝑟₀=𝜆,𝑟=𝑘𝑟−𝑟₀^𝑘𝑒𝑘!^{−𝜆(𝑟−𝑟0)}(𝑟,𝑘∈𝑍). (13)
The mathematical expectation is 𝐸𝑁(𝑟)−𝑁𝑟₀=𝜆𝑟−𝑟₀. (14) So the expectations rounds of this model are 𝜆, each time the model convergence time complexity is 𝑂(𝜆).

(3) Parameter Distributor. A machine can analog the behavior of distributor (maker) and can be a trusted server in the distributed network.

(4) Pedersen Bit Commitment Module. Pedersen bit commitment protocol [20] is a security protocol taken as commitment to the bit stream information. In each time of signature, the system generates coefficients of homogeneous constant coefficients differential equations, and the coefficients of algebraic curved 𝐹(𝑥) with order 𝑛₂−1, which correspond to the participants in set 𝐵. After storing the coefficients in the binary bits formation, we note them as form of 𝑚_𝑖(𝑖∈𝑍∧𝑚_𝑖∈{0,1}), in the form of bits stream. The parameter distributor is also attached with the bit commitment model to prevent it from attacks.

Theorem 4. The model can detect whether the parameter distributor is under attack or not.

Proof. The model adapts the Pedersen’s bit stream commitment protocol.
Parameter distributor selects a random number 𝜌∈_𝑅𝐺𝐹(𝑝^{max{𝑛1,𝑛2}})^∗, timestamp information 𝑡, and secure hash function 𝐻(𝑚_𝑖,𝑡)(𝑖∈𝑍∧𝑚_𝑖∈{0,1}).
To make bit stream and timestamp above hash process. The primitive element of group 𝐺𝐹(𝑝^{max{𝑛1,𝑛2}}) is 𝑔; publish 𝛿=𝑔^𝜌𝑦^{𝐻(𝑚𝑖,𝑡)}mod𝑝^{max{𝑛1,𝑛2}}𝑖∈𝑍∧𝑚_𝑖∈{0,1}. (15) The triple (𝜌,𝑚_𝑖,𝑡) will be publish to the public, right after the end of the signature process. Set 𝐴 and set 𝐵 participants can verify commitment to make sure whether parameter distributor is being attacked or not.

(5) Verifiable Parameter Distribution Module. Using the idea of Feldman’s [21] verification. First, publicize bivariate one-way function 𝐻(𝑥,𝑦). In each threshold signature process, parameter distributor generates polynomial with 𝑛₁−1 orders which corresponds to set 𝐴 participants: 𝐺(𝑥)=^𝑛1−1_𝑖=1𝑢_𝑖𝑥mod𝑝^𝑛1. (16)

Our model uses the primitive element in the finite fields 𝐺𝐹(𝑝^𝑛1), which is 𝑔₁, to compute the number of the operation rounds, which is 𝑟^∗, according to the Poisson distribution with parameter 𝜆, and then distribute the points sequence: 𝑥_1𝑖,𝑦_1𝑖=𝐻𝑠_1𝑖,𝑔^𝑟∗₁,𝐺𝑥_1𝑖𝑖=0,1,…,𝑛₁−1. (17) Then it arbitrarily selects 𝑛₁−𝑡₁ points in the field of 𝐹_𝑝𝑛1(𝑥,𝑦) except the ones in the equation (17), and publish them to the public.

Then it saves the vector 𝑠_1𝑖𝑖=0,1,…,2𝑛₁−𝑡₁−1, (18) and calls Pedersen’s bit commitment module.

After that, it broadcasts: 𝑉_𝑖=𝑔^𝑢𝑖₁mod𝑝^𝑛1𝑖=0,1,…,𝑛₁−1. (19) Send each participant in set 𝐴: TPK_𝑖=𝑎_𝑖+𝐺(0)mod𝑝^𝑛1,𝑖=1,2,…,𝑛₁,𝑎_𝑖∈𝐺𝐹𝑞^∗,𝐺(0)∈𝐺𝐹𝑝^𝑛1∗>sup𝑎_𝑖. (20) In the set 𝐵, the parameter distributor generates the primitive element, which is 𝑔₂, in the infinite field 𝐺𝐹(𝑝^𝑛2), according to this polynomial with 𝑛₂−1 orders: 𝐿(𝑥)=^𝑛2−1_𝑖=1𝑙_𝑖𝑥mod𝑝^𝑛2. (21)

And then, with the rounds number 𝑟^∗ noted before, the system distributes publish the points sequence: 𝑥_2𝑖,𝑦_2𝑖=𝐻𝑠_2𝑖,𝑔^𝑟∗₂,𝐿𝑥_2𝑖𝑖=0,1,…,𝑛₂−1. (22) We adopt (𝑛₂,𝑡₂) threshold structure constructed by matrix method. 𝑡₂ players in set 𝐵 participate in the repeated games and recover the secret 𝑆 using the published 𝑛₂−𝑡₂ points. As a result, the players in set 𝐴 can input 𝑆 after they get the general term formula of homogeneous constant coefficient linear differential equation.

Save vector 𝑠_2𝑖𝑖=0,1,…,2𝑛₂−𝑡₂−1. (23) And call Pedersen’s bit commitment module.

After that, it broadcasts: 𝑊_𝑖=𝑔^𝑙𝑖₂mod𝑝^𝑛2𝑖=0,1,…,𝑛₂−1. (24)

Send each participant in set 𝐵: TPK_𝑗=[𝑆+𝐿(0)]mod𝑝^𝑛2,𝑗=1,2,…,𝑛₂,𝑆∈𝐺𝐹𝑝^∗,𝐿(0)∈𝐺𝐹𝑝^𝑛2∗>𝑆. (25)

Theorem 5. The model is verifiable.

Proof. When distributing point’s sequence and broadcasting corresponding authentication information, participants can simultaneously verify the information.
Set 𝐴 participants verify 𝑔^{𝐺(𝑥1𝑖)}₁=^𝑛1−1_𝑗=0𝑉^{𝑥𝑗1𝑖}_𝑖mod𝑝^𝑛1𝑖=0,1,…,𝑛₁−1. (26)
Set 𝐵 participants verify 𝑔^{𝐿(𝑥2𝑖)}₂=^𝑛2−1_𝑗=0𝑊^{𝑥𝑗2𝑖}_𝑖mod𝑝^𝑛2𝑖=0,1,…,𝑛₂−1. (27) If the verification succeeds, participants can trust the information sent by others.

(6) Participants. Participants in two different permissions together constitute the threshold structure (𝑛₁+𝑛₂,𝑡₁+𝑡₂). In addition, |𝐴|=𝑛₁|𝐵|=𝑛₂, and the threshold values are |𝐴|_threshold=𝑡₁ and |𝐵|_threshold=𝑡₂.

(7) Okamoto Signature Module. After calculating the threshold signature private key, take TSK=𝑎_𝑆 as the first private key component of the signature module, while the second private key component is generated by public key signature method; select private keys; and publicize public keys, respectively. The model adopts Okamoto signature algorithm to signature finally.

Theorem 6. The model can resist conspiracy attack.

Proof. The second component of the private key in Okamoto signature algorithm can avoid conspiracy attacks which are performed by using general term formula to get other participants’ private keys when meeting the threshold condition to calculate homogeneous linear differential equations with constant coefficients general term formula in original model. The second component of everyone’s private key has to be kept privately by each individual. On condition that the second component of the private key ensures the privacy, the threshold signature cannot be forged. Furthermore, we can establish a mechanism, that is when there is a dispute, the system will check every participant involving the process of signature arise disputes.

3.2. Improved Threshold Model

We adopt (𝑛₂, 𝑡₂) threshold structure constructed by matrix method. 𝑡₂ players in set 𝐵 participate in the repeated games and recover the secret 𝑆 using the published 𝑛₂−𝑡₂ points. As a result, the players in set 𝐴 can input 𝑆 after they get the general term formula of homogeneous constant coefficient linear differential equation.

Make two field extensions: 𝐺𝐹𝑝^𝑛1∶𝐺𝐹𝑞=𝐺𝐹𝑝^𝑛1𝑝𝑝𝑞,𝑝∶𝐺𝐹𝐺𝐹∶𝐺𝐹𝐺𝐹^𝑛2∶𝐺𝐹𝑞=𝐺𝐹𝑝^𝑛2∶𝐺𝐹𝑝𝐺𝐹𝑝∶𝐺𝐹𝑞. (28) Expansion order of algebraic number field 𝐺𝐹(𝑞) is 𝑄₁=𝐺𝐹𝑝^𝑛1∶𝐺𝐹𝑞=𝑛₁∗𝑝−1𝑞,𝑄₂=𝐺𝐹𝑝^𝑛2∶𝐺𝐹𝑞=𝑛₂∗𝑝−1𝑞. (29)

Remove the noise terms 𝐿(0) and 𝐺(0) to get coefficients information of homogeneous constant coefficient linear differential equation.

3.3. Dynamic Game Model

Definition 7. The Computable complete and perfect information dynamic game 𝜏=[𝑃,𝑇,𝐴,𝑆,𝑅,𝐻,𝐼,𝑂,𝑈] satisfies: Participants are noted as 𝑃={Simulator,𝑃_𝑖}(Simulator represents the nature and parameter distributor). The set of  Types is 𝑇={𝑇_𝑖}(𝑇_𝑖∈{honesty,fraud}).  Actions set is 𝐴={𝐴_𝑖}(𝐴_𝑖∈{honesty,fraud}).  Strategy set is 𝑆={𝑆_𝑖}𝜑∶(𝑇_𝑖,𝐻_𝑖,𝐼_𝑖,𝐴_𝑖)→𝑆_𝑖. Rounds set is 𝑅<𝑂(𝜆)∧𝑅∈𝑍⁺. Full history set 𝐻={ℎ∣ℎ=⨁^𝑘_𝑖=1𝐴_𝑖}(𝑖∈𝑅∧0≤𝑘≤𝑅) is depicted as game tree, whose root is empty history node ∅. The information set 𝐼={𝐼_𝑖} can be tested and is perfect. Outcome set is 𝑂={𝑂_𝑖}𝛾∶(𝐴_𝑖,𝑆_𝑖)→𝑂_𝑖. Utility function set is 𝑈={𝑈_𝑖}𝛾∘𝜑∶(𝑇_𝑖,𝐻_𝑖,𝐼_𝑖,𝐴_𝑖,𝑆_𝑖,𝑂_𝑖)→𝑈_𝑖 and satisfies 𝜕²𝑈_𝑖<0. The above game 𝜏 can be calculated in polynomial time.

Definition 8. Computable complete and perfect information dynamic game with 𝑡₁+𝑡₂ elastic equilibrium will reach the equilibrium results, under the conditions that it satisfies the Definition 7 and that each participants is rational. That is, 𝑈(𝜎_𝑖,𝜎_−𝑖)<𝑈(𝜎^∗_𝑖,𝜎_−𝑖), 𝜎 is multiple real variable function 𝜎∶(𝑇_𝑖,𝐻_𝑖,𝐼_𝑖,𝐴_𝑖,𝑆_𝑖,𝑂_𝑖,𝑈_𝑖)→𝑈(𝜎_𝑖,𝜎_−𝑖).

Theorem 9. The model converges to computable complete and perfect information dynamic game with 𝑡₁+𝑡₂ elastic equilibrium.

Proof. Participants who accord with threshold signature conditions possess superiority of Pr=𝜀(0<𝜀<1). They can get threshold signature private key without the normal operation of the model. Definitions of utility functions are as follows:
𝑈⁺⁺_(0,𝑖): participants’ ideal utility without the normal operation of the model to obtain the threshold signature private key;
𝑈⁺_(𝑟,𝑖)(0≤𝑟≤𝑟^∗): the utility that participant 𝑖 gets signature private key and others do not get it in 𝑟 round;
𝑈⁻_(𝑟,𝑖)(0≤𝑟≤𝑟^∗): utility that participant 𝑖 does not comply with the normal execution of the model when model run 𝑟 round;
𝑈_(𝑟,𝑖)(0≤𝑟≤𝑟^∗): utility that participant 𝑖 complies with the normal execution of the model when model run 𝑟 round;
𝑈_{(𝑟∗,𝑖)}: normal utility that participant 𝑖 always complies with the operation of the model obtains threshold signature private key when model reaches the last one round;
𝑈⁻_(𝑟,all)(0≤𝑟≤𝑟^∗): utility that all participants do not obtain the threshold signature private key. Illustrate that there are some participants had deceived cause model abnormal termination.
Utility function satisfies the strong partial: 𝑈⁺⁺_(0,𝑖)>𝑈⁺_(𝑟,𝑖)>𝑈_{(𝑟∗,𝑖)}>𝑈⁻_(𝑟,all).
Define events as follows. A: participant uses the advantage of Pr=𝜀(0<𝜀<1) to crack threshold signature private key. B: participant implements protocol. C: participant takes honesty policy in round 𝑟. D: participant takes fraud policy in round 𝑟.We denote the utility of departing from the protocol as 𝑈_exception and denote the expected utility as 𝐸(𝑈_exception). We can get the equation as follows. 𝑈_exception((𝐴+()𝑈((𝐵,𝑈((𝐵(()(𝐶)()(𝐷=𝜀𝑈Pr))1−𝜀Pr))Pr))=𝑈Pr𝐵∣𝐶Pr+Pr𝐵∣𝐷Pr))=𝜆𝑈_{(𝑟∗,𝑖)}+(1−𝜆)^𝑟_𝑖=1𝑈⁻_(𝑟,𝑖)=𝜆𝑈_{(𝑟∗,𝑖)}+()×1−𝜆_𝑟𝑖=11𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁺_()𝑟,𝑖+𝐺𝐹𝑝^∗−1²𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁻_(𝑟,all),𝑈_exception=𝜀𝑈₍₎⁺⁺_0,𝑖+()×𝑈1−𝜀_{(𝑟∗,𝑖)}+()×1−𝜆_𝑟𝑖=11𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁺_()𝑟,𝑖+𝐺𝐹𝑝^∗−1²𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁻_(𝑟,all),𝐺𝐹𝑝∶𝐺𝐹𝑞=𝑝−1𝑞. (30) In our protocol, 𝑈_exception<𝑈_{(𝑟∗,𝑖)}. (31)
Distribution function satisfies 𝑟^∗=𝜓(𝜆). (32)
The following formulas are met: 𝑈𝜆<Φ∗^{(𝑟∗,𝑖)}−𝜀𝑈⁺⁺_(0,𝑖)−1−𝜀_𝑟𝑖=11𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁺_(𝑟,𝑖)+𝐺𝐹𝑝^∗−1²𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁻_(𝑟,all), (33) in which Φ=1×𝑈_{(𝑟∗,𝑖)}−^𝑟_𝑖=11𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁺_()𝑟,𝑖+𝐺𝐹𝑝^∗−1²𝐺𝐹𝑝^∗𝐺𝐹𝑝^∗𝑈⁻_(𝑟,all)⁻¹. (34)
The above equation can determine the range of parameters selection, so that the model converges to computable complete and perfect information dynamic game with 𝑡₁+𝑡₂ elastic equilibrium.

Theorem 10. The model can resist inner fraud.

Proof. According to Theorem 9, a rational participant will not depart from the protocol execution in any round. The model overcomes the sensitivity of backward induction and adopts mixed strategy equilibrium. If participants adopted a deceptive strategy in the model execution of any round, this caused the decrease in revenue of participants to 𝑈⁻_(𝑟,all). When the protocol terminates, punishment strategies can be used, thus putting an end to deceiving behavior effectively. So the model can prevent inner fraud.

4. Protocol Procedure

4.1. Parameters Generation Process

Determine the order of set 𝐴 and set 𝐵; determine the threshold value according to the requirements, respectively. Select big prime 𝑞,𝑝 meets 𝑞∣(𝑝−1). Select primitive element 𝑔₁ in finite field 𝐺𝐹(𝑝^𝑛1) and 𝑔₂ in finite field 𝐺𝐹(𝑝^𝑛2). The participants in set 𝐴 and set 𝐵 select signature private key as the second component of the Okamoto signature, respectively.

Parameter sequence generator generates coefficient constants vector of homogeneous constant coefficient linear differential equation: 𝑎⁰=𝑎⁰₁,𝑎⁰₂,…,𝑎⁰_𝑛−𝑡1𝑎⁰_𝑖∈𝑍_𝑞,𝑏⁰=𝑏⁰₁,𝑏⁰₂,…,𝑏⁰_𝑛−𝑡1𝑏⁰_𝑖∈𝑍_𝑞. (35)

Superscript represents signature number of times; 0 represents the first signature.

4.2. Dynamic Games Process

Rounds controller according to Poisson distribution with parameter 𝜆 secret generates threshold signature round 𝑟^∗. According to the number of participants in set 𝐴 and set 𝐵, the threshold value generates coefficient constants vector of polynomial 𝐺(𝑥) and 𝐿(𝑥), respectively: 𝑢⁰=𝑢⁰₁,𝑢⁰₂,…,𝑢⁰_𝑛1𝑢⁰_𝑖∈𝑍_𝑞𝑛1,𝑙⁰=𝑙⁰₁,𝑙⁰₂,…,𝑙⁰_𝑛2𝑙⁰_𝑖∈𝑍_𝑞𝑛2. (36)

Superscript signature represents the number of rounds; 0 represents the first round.

Parameter distributor according to (17) and (22) distributes and publicizes points. Participants in set 𝐴 and set 𝐵 can use the verifiable parameter distribution module for verification. If there is no cheating behavior, the protocol continues to execute. Otherwise, the verifiable parameter distribution module goes to the interrupt processing. In every round of the games, the players in set 𝐴 and set 𝐵 use the published points sequence and generate 𝐺(0)^𝑟 and 𝐿(0)^𝑟, respectively.

Parameter distributor verifies, respectively, TPK_𝑖−𝐺^𝑟(0)mod𝑝=^𝑛1?𝑎_𝑖,𝐺^𝑟(0)∈𝐺𝐹𝑝^𝑛1∗>sup𝑎_𝑖,𝑖=1,2,…,𝑛₁,TPK_𝑗−𝐿^𝑟(0)mod𝑝^𝑛2?𝑝=𝑆,𝑆∈𝐺𝐹^∗∧𝐿^𝑟(0)∈𝐺𝐹𝑝^𝑛2∗>𝑆,𝑗=1,2,…,𝑛₂. (37)

If 𝑟=𝑟^∗and (37) holds, calculate (2), and then TSK=𝑎_𝑆𝑆>𝑛₁+𝑛₂. (38)

If 𝑟≠𝑟^∗ and (37) does not hold, 𝐺(0)^𝑟and 𝐿^𝑟(0) equal the expected value and the protocol enters into the next round.

If 𝑟≠𝑟^∗ and (37) does not hold, meanwhile, 𝐺(0)^𝑟 and 𝐿^𝑟(0) do not equal the expected value, someone of the players have cheated. At this time, the parameter distributor can perceive the cheating behavior so that the player cannot obtain the signature private key. According to Theorem 10, the rational participants will not deceive.

4.3. Threshold Signature Process

The Okamoto signature module is used to complete the feature of signature.

Okamoto signature algorithm contains two private keys: the first is threshold signature private key just generated, and the second is each participator’s signature private key in set 𝐴 and set 𝐵. Only after verification, parameter distributor can call Okamoto signature module. Two private key generation equations are as follows: TSK₁=𝑎_𝑆𝑆>𝑛₁+𝑛₂,TSK₂=^{𝑡1+𝑡2−1}_𝑖=0SHA(𝑚)^𝑆𝐾𝑖. (39) Verify equation ^{𝑡1+𝑡2−1}_𝑖=0TSK=^𝑃𝐾𝑖₂^?SHA(𝑚). (40)

𝑚 is message sequence, and SHA is secure hash function.

We use the equation (41) to complete signature 𝜎₁,𝜎₂,𝜎₃=OkamotoTSK₁,TSK₂. (41)

Validation process can use standard Okamoto algorithm.

4.4. Several Models Comparison

Table 1 is several models comparison. The parameters range of this model uses the limiting form of (31), (32), (33), and (34).

Table 1 

Several models comparison.

5. Conclusion

This paper proposed computable complete and perfect information dynamic game with 𝑡₁+𝑡₂ elastic equilibrium, based on the homogeneous constant coefficient linear differential equation. We constructs a dynamic game model and protocol using time sequences, bit commitments, Feldman’s verification menthod, and Okamoto’s signature permissions. The model achieves two different threshold signature permissions. We proved that, during the game, no participant has the tendency of departing from normal operation, so that the model achieves the purpose of preventing fraud. Our method expands the idea of permission and overcomes five inherent problems in homogeneous constant coefficient linear differential equation.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This work is supported by the National Natural Science Foundation of China (No.61170221). The authors appreciate the help as well as the hard work of the editor.