# Anonymous Traceability Protocol Based on Group Signature for Blockchain

Authors: Qi An; Yanhui Zhang; Chong Guo; Ximing Liu; Junjia Huang; Wenzhan Zhang; Shijun Zhang; Chao Zhan; Yuxiang Cai
Journal: Security and Communication Networks
 (2022)

---

## Abstract

In blockchain technology, data are stored on decentralized nodes and public to each node in the blockchain network. Hence, the focus of privacy protection in the blockchain guarantees the anonymity of transactions such that attackers cannot attain the users’ personal information through data analysis. Among the existing privacy protection technologies, the scheme based on group signature has good anonymity, but the existing scheme exists a large number of operations that are difficult to apply to wireless terminals. In this paper, using the powerful offloading capability of edge computing, we propose a blockchain node traceable identity privacy technology scheme based on threshold group signature, and the scheme greatly reduces the computing burden of nodes while achieving node privacy protection.


---

## Body

## 1. Introduction

Blockchain has the characteristics of “decentralization” and “detrust.” Its essence is a tamper-proof distributed database, which can establish point-to-point trustworthy value transmission between unfamiliar nodes [1]. Singh et al. [2] argued that blockchain technology could be considered a communication channel in pillars of data sharing that can effectively improve accuracy and trust due to its trustworthiness and reliability, and suggested that block technology should be promoted across industries. It can be said that with the common prevalence of bitcoin, the study and usage of blockchain have exploded and can be considered as the fifth disruptive innovation in the calculation paradigm after mainframes, personal computers, the Internet, and mobile social networks [3].The blockchain system with the core idea of detrusting has the deficiency of user privacy leakage to users by making the ledger data public, and malicious attackers can directly access the data recorded in the blockchain ledger and spy on user privacy by tracing the path of all historical transactions in the ledger [4]. Therefore, the privacy protection in blockchain aims to guarantee the anonymity of transactions so that attackers cannot achieve the user’s personal information through data analysis even if they have access to the transaction data. Moreover, the stored data in the blockchain cannot be removed or changed arbitrarily. Thus, even if a user discovers the exposing of a part of his address or certain transaction information, he cannot take any salvage measures to make up for the loss [5]. In the conventional domain, it is feasible to decrease private data spread by omitting the exposed information. However, a similar scheme does not work in blockchain. This security requirement means that numerous conventional privacy protection strategies cannot be utilized in blockchain and more targeted privacy protection mechanisms need to be designed [6].There has been a lot of research on privacy protection for blockchain, and the specific techniques include mixing services [7, 8], zero-knowledge proof [9, 10], ring signatures, and group signature [11, 12]. Group signature-based identity privacy protection techniques have been widely studied. However, the computational power and performance of wireless terminals are limited, and there are a large number of existing schemes for the computation of elliptic curve dot addition, large power product, and even bilinear maps, which have high complexity and require the performance of the devices, and these schemes are not applicable in the computational environment of wireless terminals.The powerful computational offloading capability of edge computing precisely matches the need of blockchain to reduce the signature burden of nodes. The current research presents a privacy protection technique using weighted threshold group signature for blockchain networks via edge computing. In this scheme, MEC server is used to calculate and unload the signature of the blockchain terminal, which ensures the privacy of user identity and reduces the computational burden of blockchain terminal. Group administrator can open the signature and trace the real signature members when it is necessary, and the characteristic of threshold makes the scheme resist the collusion attack of members whose credibility sum is less than the threshold, which further improves the scheme’s security.The remainder of this study is arranged as follows. Section2 presents several relevant privacy-preserving techniques, and in Section 3, a mobile blockchain network model based on edge computing (MBNEC) is presented and used to introduce an identity privacy scheme regarding blockchain nodes. Section 4 deals with the scheme’s performance analysis in terms of security and effectiveness. Finally, conclusions are given in Section 5.


## 2. Related Works

This paper proposes a privacy technology of blockchain node identity based on edge computing by thresholding the classical group signature scheme. Thus, this section mainly introduces three related work areas: edge computing technologies, blockchain privacy protection technology, and group signatures and threshold group signatures.


### 2.1. Edge Computing Technologies

With the continuous promotion of smart cities, intelligent transportation, and other IoT applications and the fast growth of novel service models such as spatial location and mobile payment services, the number of IoT device connections and the produced data are significantly increasing. In order to solve the computation and storage issues, the conventional cloud computing model moves the whole data to the cloud computing center via the network and uses its strong computing capacity to achieve the centralized solving of the problems. In Internet of Everything application, cloud computing constraints such as cloud computing center load, transmission bandwidth, and data security are becoming more and more important. The great amount of data produced by several access device perception leads to more limitations of the network bandwidth of cloud computing, overwhelming the cloud and leading to more significant data bottlenecks, and the cloud computing model concentrated in the data center can no longer meet the demand. Accordingly, the edge computing model has been created.ETSI first proposed the principle of MEC (mobile edge computing) in 2014 and upgraded it to multiaccess edge computing in 2016 to meet more access needs. MEC technology mainly refers to providing IT services at the edge of mobile networks by deploying universal servers on the wireless access side environment and cloud computing capacities. Even though the computing power of the edge computing server is slightly inferior to cloud server, due to its advantage of proximity deployment, it can bring users lower latency services and effectively improve the processing efficiency of data, which is more in line with the technical requirements of Internet of Everything era.


### 2.2. Blockchain Privacy Protection Technology

The privacy leakage risk of blockchain technology has limited its promotion and application in existing industries to a certain extent. Relevant scientific and technical personnel have proposed several blockchain privacy protection schemes with different ideas to enhance the anonymity of blockchain technology and thus achieve privacy protection of user identity and transaction information.


#### 2.2.1. Mixing Services

A mixing service, first presented by Chaum [13], disrupts the correlation among the input and output addresses of transactions. Mixcoin [14], presented by Bonneau et al. in 2014, is a centralized mixing scheme with an audit function. Once a third party has an illegal behavior, the user can make the third party discredited and cannot continue mixing coins by issuing a mixed coin signature. In 2015, Valenta and Rowan [15] introduced a Blindcoin mixing technique using blind signature technology, making it impossible for the third-party center to obtain the address mapping correlation among the input and output addresses of the participating mixing coins. Also belonging to the centralized mixing scheme is DASH [16], which uses a deposit-like strategy to avoid malicious behavior by increasing the cost of crime for master nodes. To eliminate the impact generated by centralization, other related decentralized mixing schemes are CoinJoin [17], CoinShuffle [18], Xim [19], etc.


#### 2.2.2. Menero

Menero is a cryptocurrency focused on privacy protection, which utilizes extensive cryptographic techniques. In Menero, the coin mixing operation is carried out through ring signature technology. Its biggest advantage is that the coin mixing operation can be performed without the participation of a centralized third party, avoiding the centralization issue induced by centralized coin mixing and solving the decentralized coin mixing problem, where the nodes involved in coin mixing communicate with each other and leak the mixing process and the denial-of-service attack by hackers. Menero has a good implementation of unlinkability and untraceability, which are two key elements to ensure the blockchain privacy. In Menero, the stealth address technique is used to implement unlinkability, and the one-time ring signature technique is utilized to implement untraceability. The literature [20] proposes RingCT, which is an improvement of Menero to hide the addresses of both sides of the transaction as well as the transaction amount. The literature [12] proposed RingCT 2.0, which implements linkable ring signature and has a constant level of signature length, but this scheme has both inefficiency, low performance, and centralization drawbacks.


#### 2.2.3. Zcash

The zero-knowledge succinct noninteractive arguments of a knowledge (zk-SNARK) technique are optimized on top of the noninteractive zero-knowledge proof technique to maintain noninteractivity while reducing the proof size and saving. Zero Cash project [21] was proposed in 2014, which uses the zk-SNARK to construct transactions. The ZeroCash protocol can hide more transaction information including transaction amount and recipient address, which provides stronger protection for user privacy, but the implementation of the protocol also requires the participation of trusted third parties. To solve this problem, the scalable transparent zero-knowledge argument of knowledge (zk-STARK) [22] was presented, and the Aurora technique [23] was implemented on this basis to achieve transparency in the initialization phase that does not require the involvement of trusted third parties.


### 2.3. Group Signatures and Gate Group Signatures

The concept of group signature was first proposed in 1991. Group signature refers to some specific scenarios in which a member of a group will want to digitally sign a message on behalf of the group to protect the privacy of their identity, while other people can only evaluate whether the signer belongs to the group. However, unlike the group administrator, they cannot recognize the signer’s certain identity.The literature [24] proposed a secret sharing strategy using the Chinese remainder theorem without a trustworthy center; the core of which is a prime matrix that can be used in conjunction with public broadcasting channels to activate different thresholds at any time, but the scheme lacks mutual authentication between members and is easily exploited by adversaries, which is not suitable for the complex environment of edge computing networks. The threshold group signature scheme proposed in the literature [25] combines the features of elliptic curve short keys with the threshold method, which reduces the computational complexity to some extent but does not provide a method to track and revoke members in the scheme; the dynamic threshold group signature scheme [26] proposed by Xia incorporates a method for tracking and revoking members. However, this scheme is not resistant to collusion attacks; Dan et al. proposed a general method for adding threshold functions to non-threshold encryption schemes [27], which allows the key to be split into several copies and kept by multiple parties, and the scheme constructs threshold signatures that are highly secure but are only suitable for large encryption systems over short distances due to computational complexity.


## 2.1. Edge Computing Technologies

With the continuous promotion of smart cities, intelligent transportation, and other IoT applications and the fast growth of novel service models such as spatial location and mobile payment services, the number of IoT device connections and the produced data are significantly increasing. In order to solve the computation and storage issues, the conventional cloud computing model moves the whole data to the cloud computing center via the network and uses its strong computing capacity to achieve the centralized solving of the problems. In Internet of Everything application, cloud computing constraints such as cloud computing center load, transmission bandwidth, and data security are becoming more and more important. The great amount of data produced by several access device perception leads to more limitations of the network bandwidth of cloud computing, overwhelming the cloud and leading to more significant data bottlenecks, and the cloud computing model concentrated in the data center can no longer meet the demand. Accordingly, the edge computing model has been created.ETSI first proposed the principle of MEC (mobile edge computing) in 2014 and upgraded it to multiaccess edge computing in 2016 to meet more access needs. MEC technology mainly refers to providing IT services at the edge of mobile networks by deploying universal servers on the wireless access side environment and cloud computing capacities. Even though the computing power of the edge computing server is slightly inferior to cloud server, due to its advantage of proximity deployment, it can bring users lower latency services and effectively improve the processing efficiency of data, which is more in line with the technical requirements of Internet of Everything era.


## 2.2. Blockchain Privacy Protection Technology

The privacy leakage risk of blockchain technology has limited its promotion and application in existing industries to a certain extent. Relevant scientific and technical personnel have proposed several blockchain privacy protection schemes with different ideas to enhance the anonymity of blockchain technology and thus achieve privacy protection of user identity and transaction information.


### 2.2.1. Mixing Services

A mixing service, first presented by Chaum [13], disrupts the correlation among the input and output addresses of transactions. Mixcoin [14], presented by Bonneau et al. in 2014, is a centralized mixing scheme with an audit function. Once a third party has an illegal behavior, the user can make the third party discredited and cannot continue mixing coins by issuing a mixed coin signature. In 2015, Valenta and Rowan [15] introduced a Blindcoin mixing technique using blind signature technology, making it impossible for the third-party center to obtain the address mapping correlation among the input and output addresses of the participating mixing coins. Also belonging to the centralized mixing scheme is DASH [16], which uses a deposit-like strategy to avoid malicious behavior by increasing the cost of crime for master nodes. To eliminate the impact generated by centralization, other related decentralized mixing schemes are CoinJoin [17], CoinShuffle [18], Xim [19], etc.


### 2.2.2. Menero

Menero is a cryptocurrency focused on privacy protection, which utilizes extensive cryptographic techniques. In Menero, the coin mixing operation is carried out through ring signature technology. Its biggest advantage is that the coin mixing operation can be performed without the participation of a centralized third party, avoiding the centralization issue induced by centralized coin mixing and solving the decentralized coin mixing problem, where the nodes involved in coin mixing communicate with each other and leak the mixing process and the denial-of-service attack by hackers. Menero has a good implementation of unlinkability and untraceability, which are two key elements to ensure the blockchain privacy. In Menero, the stealth address technique is used to implement unlinkability, and the one-time ring signature technique is utilized to implement untraceability. The literature [20] proposes RingCT, which is an improvement of Menero to hide the addresses of both sides of the transaction as well as the transaction amount. The literature [12] proposed RingCT 2.0, which implements linkable ring signature and has a constant level of signature length, but this scheme has both inefficiency, low performance, and centralization drawbacks.


### 2.2.3. Zcash

The zero-knowledge succinct noninteractive arguments of a knowledge (zk-SNARK) technique are optimized on top of the noninteractive zero-knowledge proof technique to maintain noninteractivity while reducing the proof size and saving. Zero Cash project [21] was proposed in 2014, which uses the zk-SNARK to construct transactions. The ZeroCash protocol can hide more transaction information including transaction amount and recipient address, which provides stronger protection for user privacy, but the implementation of the protocol also requires the participation of trusted third parties. To solve this problem, the scalable transparent zero-knowledge argument of knowledge (zk-STARK) [22] was presented, and the Aurora technique [23] was implemented on this basis to achieve transparency in the initialization phase that does not require the involvement of trusted third parties.


## 2.2.1. Mixing Services

A mixing service, first presented by Chaum [13], disrupts the correlation among the input and output addresses of transactions. Mixcoin [14], presented by Bonneau et al. in 2014, is a centralized mixing scheme with an audit function. Once a third party has an illegal behavior, the user can make the third party discredited and cannot continue mixing coins by issuing a mixed coin signature. In 2015, Valenta and Rowan [15] introduced a Blindcoin mixing technique using blind signature technology, making it impossible for the third-party center to obtain the address mapping correlation among the input and output addresses of the participating mixing coins. Also belonging to the centralized mixing scheme is DASH [16], which uses a deposit-like strategy to avoid malicious behavior by increasing the cost of crime for master nodes. To eliminate the impact generated by centralization, other related decentralized mixing schemes are CoinJoin [17], CoinShuffle [18], Xim [19], etc.


## 2.2.2. Menero

Menero is a cryptocurrency focused on privacy protection, which utilizes extensive cryptographic techniques. In Menero, the coin mixing operation is carried out through ring signature technology. Its biggest advantage is that the coin mixing operation can be performed without the participation of a centralized third party, avoiding the centralization issue induced by centralized coin mixing and solving the decentralized coin mixing problem, where the nodes involved in coin mixing communicate with each other and leak the mixing process and the denial-of-service attack by hackers. Menero has a good implementation of unlinkability and untraceability, which are two key elements to ensure the blockchain privacy. In Menero, the stealth address technique is used to implement unlinkability, and the one-time ring signature technique is utilized to implement untraceability. The literature [20] proposes RingCT, which is an improvement of Menero to hide the addresses of both sides of the transaction as well as the transaction amount. The literature [12] proposed RingCT 2.0, which implements linkable ring signature and has a constant level of signature length, but this scheme has both inefficiency, low performance, and centralization drawbacks.


## 2.2.3. Zcash

The zero-knowledge succinct noninteractive arguments of a knowledge (zk-SNARK) technique are optimized on top of the noninteractive zero-knowledge proof technique to maintain noninteractivity while reducing the proof size and saving. Zero Cash project [21] was proposed in 2014, which uses the zk-SNARK to construct transactions. The ZeroCash protocol can hide more transaction information including transaction amount and recipient address, which provides stronger protection for user privacy, but the implementation of the protocol also requires the participation of trusted third parties. To solve this problem, the scalable transparent zero-knowledge argument of knowledge (zk-STARK) [22] was presented, and the Aurora technique [23] was implemented on this basis to achieve transparency in the initialization phase that does not require the involvement of trusted third parties.


## 2.3. Group Signatures and Gate Group Signatures

The concept of group signature was first proposed in 1991. Group signature refers to some specific scenarios in which a member of a group will want to digitally sign a message on behalf of the group to protect the privacy of their identity, while other people can only evaluate whether the signer belongs to the group. However, unlike the group administrator, they cannot recognize the signer’s certain identity.The literature [24] proposed a secret sharing strategy using the Chinese remainder theorem without a trustworthy center; the core of which is a prime matrix that can be used in conjunction with public broadcasting channels to activate different thresholds at any time, but the scheme lacks mutual authentication between members and is easily exploited by adversaries, which is not suitable for the complex environment of edge computing networks. The threshold group signature scheme proposed in the literature [25] combines the features of elliptic curve short keys with the threshold method, which reduces the computational complexity to some extent but does not provide a method to track and revoke members in the scheme; the dynamic threshold group signature scheme [26] proposed by Xia incorporates a method for tracking and revoking members. However, this scheme is not resistant to collusion attacks; Dan et al. proposed a general method for adding threshold functions to non-threshold encryption schemes [27], which allows the key to be split into several copies and kept by multiple parties, and the scheme constructs threshold signatures that are highly secure but are only suitable for large encryption systems over short distances due to computational complexity.


## 3. Mechanism Description

A mobile blockchain node network based on edge computing (MBNEC) is proposed. Based on MBNEC, a threshold group signature scheme to protect user privacy is given.


### 3.1. Frame of MBNEC

Mobile edge computing, as a new network model, relieves pressure on remote cloud servers and reduces network latency by migrating context-sensitive, latency sensitive, and compute-intensive tasks from mobile user tasks to nearby edge nodes for processing. These edge nodes with compute and storage resources are typically deployed in gateways, WiFi nodes, macrobase stations, and cell base stations that are in close proximity to users. In this paper, based on the network architecture of edge computing, the MEC server is given the blockchain attribute as a consensus node, and smart terminals are uplinked through the MEC server.As shown in Figure1, the blockchain layer includes a MEC server that has given blockchain attributes to act as a consensus node, as well as mobile devices, in-vehicle mobile network devices, or IoT devices that are uploaded via the server; the edge computing layer includes a local key distribution center, a local trusted management center, and a MEC server that provides computing resources for the blockchain layer and distributes security policies through the MEC server; the cloud service layer includes cloud service centers and cloud servers that provide cloud services for the edge computing layer and issue security policies. The blockchain layer guarantees the data security in transit through the blockchain, helps establish integrity assurance and anticounterfeit storage for the edge computing system, and can ensure that storage resources allocated on edge devices are fair and efficient, making them scalable. The edge computing layer gives computing resources and edge cloud services for the blockchain layer, while the cloud services layer combines the conventional cloud storage with blockchain to guarantee data security.Figure 1
Mobile blockchain node network based on edge computing.


### 3.2. Identity Privacy Scheme

At this time, the local key distribution center KDS distributes keys for the multiple MEC servers and the service wireless terminals provided by the MEC servers. The local trusted management center acts as a group administrator and can open the signature of blockchain nodes if necessary.


#### 3.2.1. System Initialization

q: a large prime numberZq: integral domainG1: q-order additive cycle groupP ：generator of G1H: Point of any nonidentity element in G1G2: q-order multiplicative cycle groupe:G1×G1⟶G2 bilinear mappingHash:0,1∗⟶Zp: hash functionIssuer/Opener: group administratorMEC: edge computing nodesKDS: local key distribution centerTMC: local trusted management centerKDS selectsγ∈ZRp∗, ξ1,ξ2∈ZRp∗ and sends ξ1,ξ2 to TMC over the secure channel. ξ1,ξ2,γ are stored by KDS and TMC as the group private key. TMC selects U,V∈G1 to make ξ1U=ξ2V=H. gpk△¯¯P,H,U,V,W is exposed as the group’s public key.


#### 3.2.2. Node Addition

We set private key and public key of blockchain terminalN0 to be x0,y0=x0P. The blockchain terminal N0 joins the local edge computing network in the following steps:Step 1. Blockchain terminalN0 sends its identity document ID0, public key y0, and connection request information Req to PKG, requesting to join the edge computing networkStep 2. PKG receives the connection request information Req and sends its identity documentIDK, public key Ppub and random number rK to blockchain terminal N0Step3. The blockchain terminalN0 selects the random number r0,r0′ to calculate s0=rKx+r0 and then sends r0′s0r0P to PKGStep 4. PKG receives the information and verifies(1)s0P=rKy0+r0P,o complete the certification to the blockchain terminalN0. Then, PKG selects a random number rK′ and calculates sK=r0′γ+rK′. PKG will send rK′sKrK′P to the blockchain terminal N0.Step 5. After blockchain terminalN0 receives the information, it verifies sKP=r0′W+rK′P to complete the certification of KDS.(2)s0P=rKx+r0P=rKy0+r0P.The correctness of the above scheme is obvious. In addition, the above literature is typical of zero-knowledge proofs, whose safety analysis can be proved by traditional methods; this paper ignores the main proof process.


#### 3.2.3. Distribution of Keys

We set TMC to manageN wireless terminals, divided into n group members. The transaction signature of the n-th group member GNi is completed by the wireless terminal Ni,1,…,Ni,si through threshold signature.x1V1+⋯+xtVt≥k, V1,…,Vt, k is a positive integer.KDS selectsxi∈ZRp∗1≤i≤n for group member GNi and calculates Ai=1/γ+xiP. KDS sends Ai to TMC and selects polynomial fxf1xf2xf3xf4x described on Zq and polynomial gx defined on G1.(3)fx=xi+∑j=1k−1bjxj,f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj,gx=Ai+∑j=1k−1Bjxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(4)si,j,l=fIDi+l,l=1,2,…,Vi,j,αi,j,l=f1IDi+l,l=1,2,…,Vi,j,βi,j,l=f2IDi+l,l=1,2,…,Vi,j,γi,j,l=f3IDi+l,l=1,2,…,Vi,j,ηi,j,l=f4IDi+l,l=1,2,…,Vi,j,Ai,j,l=gIDi+l,l=1,2,…,Vi,j.KDS sendssi,j,1,Ai,j,1,αi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,si,j,Vi,j,Ai,j,Vi,j to Ni,j through the secure channel.In order to reduce the burden on wireless terminals, KDS presets the one-time values to be used for signing as follows: KDS selects the polynomialf1xf2xf3xf4x described on Zq and the polynomial gx defined on G1.(5)f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(6)αi,j,l=f1IDi+l,l=1,2,………,Vi,j,βi,j,l=f2IDi+l,l=1,2,………,Vi,j,γi,j,l=f3IDi+l,l=1,2,………,Vi,j,ηi,j,l=fIDi+l,l=1,2,………,Vi,j.KDS sendsαi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,αi,j,Vi,j,βi,j,Vi,j,γi,j,Vi,j,ηi,j,Vi,j to Ni,j through the secure channel. αi,j,l,βi,j,l,γi,j,l,ηi,j,l can generate multiple groups at once and send them to the wireless terminal for storage. A set of αi,j,l,βi,j,l,γi,j,l,ηi,j,l is used only once for a signature.


#### 3.2.4. Key Update

We consider that thei-th group member GNi corresponds to the wireless terminal locally aware network. Now, KDS updates the public parameters in the following manner:(1)
Update of group public key.(7)P′=Ai,W′=P−xiAi.At this time,(8)W′=P−xiAi=P−xiγ+xiP=γγ+xiP=γP′.Meet the form that the group public key should have.(2)
Update of the other group member.For each group memberGNjj≠i, KDS calculates(9)Aj′=1xj−xiAi−1xj−xiAj.At this time,(10)Aj′=1xj−xiAi−1xj−xiAj=1xj−xjγ+xiP−1xj−x1γ+xjP=1γ+xjPγ+xi=1γ+xjP′.Meet the form that the group public key should have.KDS selects the polynomialgx defined on G1(11)gx=Ai′+∑i=1k−1Bi′xi.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(12)Ai,j,l′=fIDi+l,l=1,2,………,Vi,j.KDS sendsAi,j,1,…,Ai,j,Vi,j to Ni,j through the secure channel.


#### 3.2.5. Signature

Considering the group public keygpk△¯¯P,H,U,V,W, nodes N1,….,Nm corresponding to the j-th group member GNj jointly sign message m∈0,1∗. The sum of the weights corresponding to N1,….,Nm is greater or equal to k.(i)
N1,….,Nm, respectively, select random numbers rα,i,rβ,i,rx,i,rδ1,i,rδ2,i∈ZRp∗ and broadcast them. We set the weight of Ni to be Vi ; the secret fragment it has for signing is αi,1,βi,1,…,αi,Vi,βi,Vi. Then, the node computes. Then, Ni calculates(13)Ti,1=∑t=1Viλi,tαi,tU,Ti,2=∑t=1Viλi,tαi,tV,Ti,3=∑t=1Viλi,tAt+∑t=1Viλi,tαi,t+βi,tH.N1,….,Nm broadcast(14)T1,1,T1,2,T1,3,….,Tm,1,Tm,2,Tm,3.(ii)
MEC calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
R1=rαU,R2=rβV,R3=eT3,PrxeH,W−rα−rβH,P−rδ1−rδ2,R4=rxT1−rδ1U,R5=rxT2−rδ2V(3)
T1=∑i=1mTi,1,T2=∑i=1mTi,2,T3=∑i=1mTi,3(4)
c=Hm,T1,T2,T3,R1,R2,R3,R4,R5Then, MEC broadcastc.(iii)
N1,....,Nm calculate(15)rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i,sα=rα+cα,sβ=rβ+cβ.(iv)
We set the weight of nodeNi to Vi. The secret clips are as follows:(16)si,1,Ai,1,αi,1,βi,1,γi,1,ηi,1,…,si,Vi,Ai,Vi,αi,Vi,βi,Vi,γi,Vi,ηi,Vi.Ni selects ri,x,ri,α,ri,β,ri,δ1,ri,δ2∈ZRp∗ and calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
si,x,1=cλi,1si,1Hashm,si,α,1=cλi,1αi,1Hashm,si,β,1=cλi,1βi,1Hashm(17)si,δ1,1=cλi,1γi,1Hashm,si,δ2,1=cλi,1ηi,1Hashm,si,x,Vi=cλi,Visi,ViHashm+ri,x+rxm,si,α,Vi=cλi,Viαi,ViHashm−ri,α+rαm,si,β,Vi=cλi,Viβi,ViHashm−ri,β+rβm,si,δ1,Vi=cλi,Viγi,ViHashm−ri,δ1+rδ1m,si,δ2,Vi=cλi,Viηi,ViHashm−ri,δ2+rδ2m.And(18)si,x=∑t=1Visi,x,t,si,α=∑t=1Visi,α,t,si,β=∑t=1Visi,β,t,si,δ1=∑t=1Visi,δ1,t,si,δ2=∑t=1Visi,δ2,t,Si,x=eT3,Pri,xeH,Pri,α+ri,βeH,Wri,δ1+ri,δ2,Si,α=−ri,αU,Si,β=−ri,βV,Si,δ1=ri,δ1U−ri,xT1,Si,δ2=ri,δ2V−ri,xT2.Wireless terminalN1,….,Nm sends(19)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,….,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,to MEC.Note: in order to reduce the computing burden of wireless terminals, multiple groups ofri,x,ri,α,ri,β,ri,δ1,ri,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2 can be preset by KDS, and different groups are adopted for each signature.(v)
MEC collects(20)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,…,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,and calculates(21)sx=∑i=1msi,x,sα=∑i=1msi,α,sβ=∑i=1msi,β,sδ1=∑i=1msi,δ1,sδ2=∑i=1msi,δ2.T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2 is output as the signature of group member GNj for message m.


#### 3.2.6. Signature Verification

Given the group public keygpk=P,H,U,V,W, the message m, and the signature to be verified T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2.Any recipient can verify whether the signature is legal by performing the following operations:(1)
calculate(22)R1′=sαU−cT1+Sα,R2′=sβV−cT2+S,R4′=sxT1−sδ1U+Sδ1,R5′=sxT2−sδ2V+Sδ2,R3′=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,WeP,PcSx.(2)
Accept the signature as a valid group signature if and only ifc=Hm,T1,T2,T3,R1′,R2′,R3′,R4′,R5′.


#### 3.2.7. Correctness

The correctness of scheme holds:R1=R1′,R2=R2′,R4=R4′,R5=R5′ can be easily obtained; the following mainly proves that R3=R3′.According to the characteristics of threshold cipher,(23)∑i=1m∑j=1Viλi,jfIDi+j=xi.Therefore,(24)R3′=eT3,PrxeH,W−rα−rβeH,P−rδ1−rδ2Sx=eT3,Psx−cxieH,W−sα−sβ+cα+cβeH,P−sδ1−sδ2+cδ1+cδ2eT3,P−rx,ieH,P−rα,i−rβ,ieH,W−ri,δ1−ri,δ2Sx=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2.Due to(25)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eH,Wcα+cβeH,Pcδ1+cδ2eT3,Pcxi=eα+βH,WceH,Pcδ1+cδ2eT3,Pcxi=eT3−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,Wce−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,WceH,Pcδ1+cδ2eAi,WceT3,Pcxi=eT3,WceH,Pcxiα+βeAi,WceT3,Pcxi=eT3,Wceα+βH,PcxieAi,WceT3,Pcxi=eT3,Wceα+βH−T3,PcxieAi,Wc=eT3,Wce−Ai,PcxieAi,Wc=eT3,WceAi,xiP+W−c=eT3,WceP,P−c.That is,(26)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eT3,WeP,Pc.Therefore,R3=R3′.


## 3.1. Frame of MBNEC

Mobile edge computing, as a new network model, relieves pressure on remote cloud servers and reduces network latency by migrating context-sensitive, latency sensitive, and compute-intensive tasks from mobile user tasks to nearby edge nodes for processing. These edge nodes with compute and storage resources are typically deployed in gateways, WiFi nodes, macrobase stations, and cell base stations that are in close proximity to users. In this paper, based on the network architecture of edge computing, the MEC server is given the blockchain attribute as a consensus node, and smart terminals are uplinked through the MEC server.As shown in Figure1, the blockchain layer includes a MEC server that has given blockchain attributes to act as a consensus node, as well as mobile devices, in-vehicle mobile network devices, or IoT devices that are uploaded via the server; the edge computing layer includes a local key distribution center, a local trusted management center, and a MEC server that provides computing resources for the blockchain layer and distributes security policies through the MEC server; the cloud service layer includes cloud service centers and cloud servers that provide cloud services for the edge computing layer and issue security policies. The blockchain layer guarantees the data security in transit through the blockchain, helps establish integrity assurance and anticounterfeit storage for the edge computing system, and can ensure that storage resources allocated on edge devices are fair and efficient, making them scalable. The edge computing layer gives computing resources and edge cloud services for the blockchain layer, while the cloud services layer combines the conventional cloud storage with blockchain to guarantee data security.Figure 1
Mobile blockchain node network based on edge computing.


## 3.2. Identity Privacy Scheme

At this time, the local key distribution center KDS distributes keys for the multiple MEC servers and the service wireless terminals provided by the MEC servers. The local trusted management center acts as a group administrator and can open the signature of blockchain nodes if necessary.


### 3.2.1. System Initialization

q: a large prime numberZq: integral domainG1: q-order additive cycle groupP ：generator of G1H: Point of any nonidentity element in G1G2: q-order multiplicative cycle groupe:G1×G1⟶G2 bilinear mappingHash:0,1∗⟶Zp: hash functionIssuer/Opener: group administratorMEC: edge computing nodesKDS: local key distribution centerTMC: local trusted management centerKDS selectsγ∈ZRp∗, ξ1,ξ2∈ZRp∗ and sends ξ1,ξ2 to TMC over the secure channel. ξ1,ξ2,γ are stored by KDS and TMC as the group private key. TMC selects U,V∈G1 to make ξ1U=ξ2V=H. gpk△¯¯P,H,U,V,W is exposed as the group’s public key.


### 3.2.2. Node Addition

We set private key and public key of blockchain terminalN0 to be x0,y0=x0P. The blockchain terminal N0 joins the local edge computing network in the following steps:Step 1. Blockchain terminalN0 sends its identity document ID0, public key y0, and connection request information Req to PKG, requesting to join the edge computing networkStep 2. PKG receives the connection request information Req and sends its identity documentIDK, public key Ppub and random number rK to blockchain terminal N0Step3. The blockchain terminalN0 selects the random number r0,r0′ to calculate s0=rKx+r0 and then sends r0′s0r0P to PKGStep 4. PKG receives the information and verifies(1)s0P=rKy0+r0P,o complete the certification to the blockchain terminalN0. Then, PKG selects a random number rK′ and calculates sK=r0′γ+rK′. PKG will send rK′sKrK′P to the blockchain terminal N0.Step 5. After blockchain terminalN0 receives the information, it verifies sKP=r0′W+rK′P to complete the certification of KDS.(2)s0P=rKx+r0P=rKy0+r0P.The correctness of the above scheme is obvious. In addition, the above literature is typical of zero-knowledge proofs, whose safety analysis can be proved by traditional methods; this paper ignores the main proof process.


### 3.2.3. Distribution of Keys

We set TMC to manageN wireless terminals, divided into n group members. The transaction signature of the n-th group member GNi is completed by the wireless terminal Ni,1,…,Ni,si through threshold signature.x1V1+⋯+xtVt≥k, V1,…,Vt, k is a positive integer.KDS selectsxi∈ZRp∗1≤i≤n for group member GNi and calculates Ai=1/γ+xiP. KDS sends Ai to TMC and selects polynomial fxf1xf2xf3xf4x described on Zq and polynomial gx defined on G1.(3)fx=xi+∑j=1k−1bjxj,f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj,gx=Ai+∑j=1k−1Bjxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(4)si,j,l=fIDi+l,l=1,2,…,Vi,j,αi,j,l=f1IDi+l,l=1,2,…,Vi,j,βi,j,l=f2IDi+l,l=1,2,…,Vi,j,γi,j,l=f3IDi+l,l=1,2,…,Vi,j,ηi,j,l=f4IDi+l,l=1,2,…,Vi,j,Ai,j,l=gIDi+l,l=1,2,…,Vi,j.KDS sendssi,j,1,Ai,j,1,αi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,si,j,Vi,j,Ai,j,Vi,j to Ni,j through the secure channel.In order to reduce the burden on wireless terminals, KDS presets the one-time values to be used for signing as follows: KDS selects the polynomialf1xf2xf3xf4x described on Zq and the polynomial gx defined on G1.(5)f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(6)αi,j,l=f1IDi+l,l=1,2,………,Vi,j,βi,j,l=f2IDi+l,l=1,2,………,Vi,j,γi,j,l=f3IDi+l,l=1,2,………,Vi,j,ηi,j,l=fIDi+l,l=1,2,………,Vi,j.KDS sendsαi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,αi,j,Vi,j,βi,j,Vi,j,γi,j,Vi,j,ηi,j,Vi,j to Ni,j through the secure channel. αi,j,l,βi,j,l,γi,j,l,ηi,j,l can generate multiple groups at once and send them to the wireless terminal for storage. A set of αi,j,l,βi,j,l,γi,j,l,ηi,j,l is used only once for a signature.


### 3.2.4. Key Update

We consider that thei-th group member GNi corresponds to the wireless terminal locally aware network. Now, KDS updates the public parameters in the following manner:(1)
Update of group public key.(7)P′=Ai,W′=P−xiAi.At this time,(8)W′=P−xiAi=P−xiγ+xiP=γγ+xiP=γP′.Meet the form that the group public key should have.(2)
Update of the other group member.For each group memberGNjj≠i, KDS calculates(9)Aj′=1xj−xiAi−1xj−xiAj.At this time,(10)Aj′=1xj−xiAi−1xj−xiAj=1xj−xjγ+xiP−1xj−x1γ+xjP=1γ+xjPγ+xi=1γ+xjP′.Meet the form that the group public key should have.KDS selects the polynomialgx defined on G1(11)gx=Ai′+∑i=1k−1Bi′xi.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(12)Ai,j,l′=fIDi+l,l=1,2,………,Vi,j.KDS sendsAi,j,1,…,Ai,j,Vi,j to Ni,j through the secure channel.


### 3.2.5. Signature

Considering the group public keygpk△¯¯P,H,U,V,W, nodes N1,….,Nm corresponding to the j-th group member GNj jointly sign message m∈0,1∗. The sum of the weights corresponding to N1,….,Nm is greater or equal to k.(i)
N1,….,Nm, respectively, select random numbers rα,i,rβ,i,rx,i,rδ1,i,rδ2,i∈ZRp∗ and broadcast them. We set the weight of Ni to be Vi ; the secret fragment it has for signing is αi,1,βi,1,…,αi,Vi,βi,Vi. Then, the node computes. Then, Ni calculates(13)Ti,1=∑t=1Viλi,tαi,tU,Ti,2=∑t=1Viλi,tαi,tV,Ti,3=∑t=1Viλi,tAt+∑t=1Viλi,tαi,t+βi,tH.N1,….,Nm broadcast(14)T1,1,T1,2,T1,3,….,Tm,1,Tm,2,Tm,3.(ii)
MEC calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
R1=rαU,R2=rβV,R3=eT3,PrxeH,W−rα−rβH,P−rδ1−rδ2,R4=rxT1−rδ1U,R5=rxT2−rδ2V(3)
T1=∑i=1mTi,1,T2=∑i=1mTi,2,T3=∑i=1mTi,3(4)
c=Hm,T1,T2,T3,R1,R2,R3,R4,R5Then, MEC broadcastc.(iii)
N1,....,Nm calculate(15)rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i,sα=rα+cα,sβ=rβ+cβ.(iv)
We set the weight of nodeNi to Vi. The secret clips are as follows:(16)si,1,Ai,1,αi,1,βi,1,γi,1,ηi,1,…,si,Vi,Ai,Vi,αi,Vi,βi,Vi,γi,Vi,ηi,Vi.Ni selects ri,x,ri,α,ri,β,ri,δ1,ri,δ2∈ZRp∗ and calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
si,x,1=cλi,1si,1Hashm,si,α,1=cλi,1αi,1Hashm,si,β,1=cλi,1βi,1Hashm(17)si,δ1,1=cλi,1γi,1Hashm,si,δ2,1=cλi,1ηi,1Hashm,si,x,Vi=cλi,Visi,ViHashm+ri,x+rxm,si,α,Vi=cλi,Viαi,ViHashm−ri,α+rαm,si,β,Vi=cλi,Viβi,ViHashm−ri,β+rβm,si,δ1,Vi=cλi,Viγi,ViHashm−ri,δ1+rδ1m,si,δ2,Vi=cλi,Viηi,ViHashm−ri,δ2+rδ2m.And(18)si,x=∑t=1Visi,x,t,si,α=∑t=1Visi,α,t,si,β=∑t=1Visi,β,t,si,δ1=∑t=1Visi,δ1,t,si,δ2=∑t=1Visi,δ2,t,Si,x=eT3,Pri,xeH,Pri,α+ri,βeH,Wri,δ1+ri,δ2,Si,α=−ri,αU,Si,β=−ri,βV,Si,δ1=ri,δ1U−ri,xT1,Si,δ2=ri,δ2V−ri,xT2.Wireless terminalN1,….,Nm sends(19)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,….,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,to MEC.Note: in order to reduce the computing burden of wireless terminals, multiple groups ofri,x,ri,α,ri,β,ri,δ1,ri,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2 can be preset by KDS, and different groups are adopted for each signature.(v)
MEC collects(20)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,…,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,and calculates(21)sx=∑i=1msi,x,sα=∑i=1msi,α,sβ=∑i=1msi,β,sδ1=∑i=1msi,δ1,sδ2=∑i=1msi,δ2.T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2 is output as the signature of group member GNj for message m.


### 3.2.6. Signature Verification

Given the group public keygpk=P,H,U,V,W, the message m, and the signature to be verified T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2.Any recipient can verify whether the signature is legal by performing the following operations:(1)
calculate(22)R1′=sαU−cT1+Sα,R2′=sβV−cT2+S,R4′=sxT1−sδ1U+Sδ1,R5′=sxT2−sδ2V+Sδ2,R3′=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,WeP,PcSx.(2)
Accept the signature as a valid group signature if and only ifc=Hm,T1,T2,T3,R1′,R2′,R3′,R4′,R5′.


### 3.2.7. Correctness

The correctness of scheme holds:R1=R1′,R2=R2′,R4=R4′,R5=R5′ can be easily obtained; the following mainly proves that R3=R3′.According to the characteristics of threshold cipher,(23)∑i=1m∑j=1Viλi,jfIDi+j=xi.Therefore,(24)R3′=eT3,PrxeH,W−rα−rβeH,P−rδ1−rδ2Sx=eT3,Psx−cxieH,W−sα−sβ+cα+cβeH,P−sδ1−sδ2+cδ1+cδ2eT3,P−rx,ieH,P−rα,i−rβ,ieH,W−ri,δ1−ri,δ2Sx=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2.Due to(25)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eH,Wcα+cβeH,Pcδ1+cδ2eT3,Pcxi=eα+βH,WceH,Pcδ1+cδ2eT3,Pcxi=eT3−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,Wce−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,WceH,Pcδ1+cδ2eAi,WceT3,Pcxi=eT3,WceH,Pcxiα+βeAi,WceT3,Pcxi=eT3,Wceα+βH,PcxieAi,WceT3,Pcxi=eT3,Wceα+βH−T3,PcxieAi,Wc=eT3,Wce−Ai,PcxieAi,Wc=eT3,WceAi,xiP+W−c=eT3,WceP,P−c.That is,(26)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eT3,WeP,Pc.Therefore,R3=R3′.


## 3.2.1. System Initialization

q: a large prime numberZq: integral domainG1: q-order additive cycle groupP ：generator of G1H: Point of any nonidentity element in G1G2: q-order multiplicative cycle groupe:G1×G1⟶G2 bilinear mappingHash:0,1∗⟶Zp: hash functionIssuer/Opener: group administratorMEC: edge computing nodesKDS: local key distribution centerTMC: local trusted management centerKDS selectsγ∈ZRp∗, ξ1,ξ2∈ZRp∗ and sends ξ1,ξ2 to TMC over the secure channel. ξ1,ξ2,γ are stored by KDS and TMC as the group private key. TMC selects U,V∈G1 to make ξ1U=ξ2V=H. gpk△¯¯P,H,U,V,W is exposed as the group’s public key.


## 3.2.2. Node Addition

We set private key and public key of blockchain terminalN0 to be x0,y0=x0P. The blockchain terminal N0 joins the local edge computing network in the following steps:Step 1. Blockchain terminalN0 sends its identity document ID0, public key y0, and connection request information Req to PKG, requesting to join the edge computing networkStep 2. PKG receives the connection request information Req and sends its identity documentIDK, public key Ppub and random number rK to blockchain terminal N0Step3. The blockchain terminalN0 selects the random number r0,r0′ to calculate s0=rKx+r0 and then sends r0′s0r0P to PKGStep 4. PKG receives the information and verifies(1)s0P=rKy0+r0P,o complete the certification to the blockchain terminalN0. Then, PKG selects a random number rK′ and calculates sK=r0′γ+rK′. PKG will send rK′sKrK′P to the blockchain terminal N0.Step 5. After blockchain terminalN0 receives the information, it verifies sKP=r0′W+rK′P to complete the certification of KDS.(2)s0P=rKx+r0P=rKy0+r0P.The correctness of the above scheme is obvious. In addition, the above literature is typical of zero-knowledge proofs, whose safety analysis can be proved by traditional methods; this paper ignores the main proof process.


## 3.2.3. Distribution of Keys

We set TMC to manageN wireless terminals, divided into n group members. The transaction signature of the n-th group member GNi is completed by the wireless terminal Ni,1,…,Ni,si through threshold signature.x1V1+⋯+xtVt≥k, V1,…,Vt, k is a positive integer.KDS selectsxi∈ZRp∗1≤i≤n for group member GNi and calculates Ai=1/γ+xiP. KDS sends Ai to TMC and selects polynomial fxf1xf2xf3xf4x described on Zq and polynomial gx defined on G1.(3)fx=xi+∑j=1k−1bjxj,f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj,gx=Ai+∑j=1k−1Bjxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(4)si,j,l=fIDi+l,l=1,2,…,Vi,j,αi,j,l=f1IDi+l,l=1,2,…,Vi,j,βi,j,l=f2IDi+l,l=1,2,…,Vi,j,γi,j,l=f3IDi+l,l=1,2,…,Vi,j,ηi,j,l=f4IDi+l,l=1,2,…,Vi,j,Ai,j,l=gIDi+l,l=1,2,…,Vi,j.KDS sendssi,j,1,Ai,j,1,αi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,si,j,Vi,j,Ai,j,Vi,j to Ni,j through the secure channel.In order to reduce the burden on wireless terminals, KDS presets the one-time values to be used for signing as follows: KDS selects the polynomialf1xf2xf3xf4x described on Zq and the polynomial gx defined on G1.(5)f1x=αi+∑j=1k−1b1,jxj,f2x=βi+∑j=1k−1b2,jxj,f3x=αixi+∑j=1k−1b3,jxj,f4x=βixi+∑j=1k−1b4,jxj.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(6)αi,j,l=f1IDi+l,l=1,2,………,Vi,j,βi,j,l=f2IDi+l,l=1,2,………,Vi,j,γi,j,l=f3IDi+l,l=1,2,………,Vi,j,ηi,j,l=fIDi+l,l=1,2,………,Vi,j.KDS sendsαi,j,1,βi,j,1,γi,j,1,ηi,j,1,…,αi,j,Vi,j,βi,j,Vi,j,γi,j,Vi,j,ηi,j,Vi,j to Ni,j through the secure channel. αi,j,l,βi,j,l,γi,j,l,ηi,j,l can generate multiple groups at once and send them to the wireless terminal for storage. A set of αi,j,l,βi,j,l,γi,j,l,ηi,j,l is used only once for a signature.


## 3.2.4. Key Update

We consider that thei-th group member GNi corresponds to the wireless terminal locally aware network. Now, KDS updates the public parameters in the following manner:(1)
Update of group public key.(7)P′=Ai,W′=P−xiAi.At this time,(8)W′=P−xiAi=P−xiγ+xiP=γγ+xiP=γP′.Meet the form that the group public key should have.(2)
Update of the other group member.For each group memberGNjj≠i, KDS calculates(9)Aj′=1xj−xiAi−1xj−xiAj.At this time,(10)Aj′=1xj−xiAi−1xj−xiAj=1xj−xjγ+xiP−1xj−x1γ+xjP=1γ+xjPγ+xi=1γ+xjP′.Meet the form that the group public key should have.KDS selects the polynomialgx defined on G1(11)gx=Ai′+∑i=1k−1Bi′xi.For each wireless terminalNi,j1≤j≤si, we set its weight to Vi,j. KDS calculates(12)Ai,j,l′=fIDi+l,l=1,2,………,Vi,j.KDS sendsAi,j,1,…,Ai,j,Vi,j to Ni,j through the secure channel.


## 3.2.5. Signature

Considering the group public keygpk△¯¯P,H,U,V,W, nodes N1,….,Nm corresponding to the j-th group member GNj jointly sign message m∈0,1∗. The sum of the weights corresponding to N1,….,Nm is greater or equal to k.(i)
N1,….,Nm, respectively, select random numbers rα,i,rβ,i,rx,i,rδ1,i,rδ2,i∈ZRp∗ and broadcast them. We set the weight of Ni to be Vi ; the secret fragment it has for signing is αi,1,βi,1,…,αi,Vi,βi,Vi. Then, the node computes. Then, Ni calculates(13)Ti,1=∑t=1Viλi,tαi,tU,Ti,2=∑t=1Viλi,tαi,tV,Ti,3=∑t=1Viλi,tAt+∑t=1Viλi,tαi,t+βi,tH.N1,….,Nm broadcast(14)T1,1,T1,2,T1,3,….,Tm,1,Tm,2,Tm,3.(ii)
MEC calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
R1=rαU,R2=rβV,R3=eT3,PrxeH,W−rα−rβH,P−rδ1−rδ2,R4=rxT1−rδ1U,R5=rxT2−rδ2V(3)
T1=∑i=1mTi,1,T2=∑i=1mTi,2,T3=∑i=1mTi,3(4)
c=Hm,T1,T2,T3,R1,R2,R3,R4,R5Then, MEC broadcastc.(iii)
N1,....,Nm calculate(15)rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i,sα=rα+cα,sβ=rβ+cβ.(iv)
We set the weight of nodeNi to Vi. The secret clips are as follows:(16)si,1,Ai,1,αi,1,βi,1,γi,1,ηi,1,…,si,Vi,Ai,Vi,αi,Vi,βi,Vi,γi,Vi,ηi,Vi.Ni selects ri,x,ri,α,ri,β,ri,δ1,ri,δ2∈ZRp∗ and calculates(1)
rα=∏i=1mrα,i,rβ=∏i=1mrβ,i,rx=∏i=1mrx,i,rδ1=∏i=1mrδ1,i,rδ2=∏i=1mrδ2,i(2)
si,x,1=cλi,1si,1Hashm,si,α,1=cλi,1αi,1Hashm,si,β,1=cλi,1βi,1Hashm(17)si,δ1,1=cλi,1γi,1Hashm,si,δ2,1=cλi,1ηi,1Hashm,si,x,Vi=cλi,Visi,ViHashm+ri,x+rxm,si,α,Vi=cλi,Viαi,ViHashm−ri,α+rαm,si,β,Vi=cλi,Viβi,ViHashm−ri,β+rβm,si,δ1,Vi=cλi,Viγi,ViHashm−ri,δ1+rδ1m,si,δ2,Vi=cλi,Viηi,ViHashm−ri,δ2+rδ2m.And(18)si,x=∑t=1Visi,x,t,si,α=∑t=1Visi,α,t,si,β=∑t=1Visi,β,t,si,δ1=∑t=1Visi,δ1,t,si,δ2=∑t=1Visi,δ2,t,Si,x=eT3,Pri,xeH,Pri,α+ri,βeH,Wri,δ1+ri,δ2,Si,α=−ri,αU,Si,β=−ri,βV,Si,δ1=ri,δ1U−ri,xT1,Si,δ2=ri,δ2V−ri,xT2.Wireless terminalN1,….,Nm sends(19)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,….,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,to MEC.Note: in order to reduce the computing burden of wireless terminals, multiple groups ofri,x,ri,α,ri,β,ri,δ1,ri,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2 can be preset by KDS, and different groups are adopted for each signature.(v)
MEC collects(20)s1,α,s1,β,s1,x,s1,δ1,s1,δ2,S1,x,S1,α,S1,α,S1,δ1,S1,δ2,…,sm,α,sm,β,sm,x,sm,δ1,sm,δ2,Sm,x,Sm,α,Sm,α,Sm,δ1,Sm,δ2,and calculates(21)sx=∑i=1msi,x,sα=∑i=1msi,α,sβ=∑i=1msi,β,sδ1=∑i=1msi,δ1,sδ2=∑i=1msi,δ2.T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2 is output as the signature of group member GNj for message m.


## 3.2.6. Signature Verification

Given the group public keygpk=P,H,U,V,W, the message m, and the signature to be verified T1,T2,T3,c,sα,sβ,s1,x,sδ1,sδ2,Sx,Sα,Sβ,Sδ1,Sδ2.Any recipient can verify whether the signature is legal by performing the following operations:(1)
calculate(22)R1′=sαU−cT1+Sα,R2′=sβV−cT2+S,R4′=sxT1−sδ1U+Sδ1,R5′=sxT2−sδ2V+Sδ2,R3′=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,WeP,PcSx.(2)
Accept the signature as a valid group signature if and only ifc=Hm,T1,T2,T3,R1′,R2′,R3′,R4′,R5′.


## 3.2.7. Correctness

The correctness of scheme holds:R1=R1′,R2=R2′,R4=R4′,R5=R5′ can be easily obtained; the following mainly proves that R3=R3′.According to the characteristics of threshold cipher,(23)∑i=1m∑j=1Viλi,jfIDi+j=xi.Therefore,(24)R3′=eT3,PrxeH,W−rα−rβeH,P−rδ1−rδ2Sx=eT3,Psx−cxieH,W−sα−sβ+cα+cβeH,P−sδ1−sδ2+cδ1+cδ2eT3,P−rx,ieH,P−rα,i−rβ,ieH,W−ri,δ1−ri,δ2Sx=eT3,PsxeH,W−sα−sβeH,P−sδ1−sδ2eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2.Due to(25)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eH,Wcα+cβeH,Pcδ1+cδ2eT3,Pcxi=eα+βH,WceH,Pcδ1+cδ2eT3,Pcxi=eT3−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,Wce−Ai,WceH,Pcδ1+cδ2eT3,Pcxi=eT3,WceH,Pcδ1+cδ2eAi,WceT3,Pcxi=eT3,WceH,Pcxiα+βeAi,WceT3,Pcxi=eT3,Wceα+βH,PcxieAi,WceT3,Pcxi=eT3,Wceα+βH−T3,PcxieAi,Wc=eT3,Wce−Ai,PcxieAi,Wc=eT3,WceAi,xiP+W−c=eT3,WceP,P−c.That is,(26)eT3,P−cxieH,Wcα+cβeH,Pcδ1+cδ2=eT3,WeP,Pc.Therefore,R3=R3′.


## 4. Performance Analysis

To verify the correctness of the solution and to reflect the superiority of its efficiency, the solution’s safety and efficiency analysis are performed.


### 4.1. Security Analysis

The presented scheme is the threshold of typical group signature scheme, and its security is mainly determined by the original group signature scheme and threshold scheme. The unforgeability and anonymity of the original ring proof scheme have been proved [28]. Therefore, the following study will focus on the analysis of the impact of the weighted threshold.


#### 4.1.1. Unforgeability

In this weighted threshold scheme, if all nodes distribute their own keys for the second time so that after distribution, each member of the group only holds one key segment, the node that originally held the key performs key security reimbursement then, this scheme becomes a typical verifiable threshold scheme [29]. According to the characteristics of threshold, any node combination whose weight sum is less than the threshold cannot complete the signature, and any node combination whose weight sum is higher than or equal to the threshold can complete the signature. Thus, the mentioned scheme can resist the collusion attack of any member whose credibility sum is less than the threshold.


#### 4.1.2. Anonymity Analysis

Anonymity of signature means that for a given group signature, only TMC, the group administrator, can open the signature and trace the real signature member. With the introduction of threshold signature, the signature completed by a single group member in the original scheme is expanded to be signed jointly by multiple wireless terminals. The threshold signature in this paper is based on the principle of zero-knowledge proof that does not disclose the relevant information of the private key in the signature process. According to the characteristics of group signature [30], only the group administrator Issuer can open the signature, which shows that this scheme satisfies anonymity.


#### 4.1.3. Traceability Analysis

TMC can trace the identity of a group member that generated the signature by performing the following operations:(1)
Execute the signature verification algorithm to ensure that the signature is a correct group signature for messagem(2)
CalculateA=T3−ξ1T1+ξ2T2 to check the correspondence table between Ai and group membership, thereby to determine the identity of the group member that produced the signature


#### 4.1.4. Unlinkability Analysis

It is said to be uncorrelated if there are two signatures, satisfying the requirement that only the TMC can identify whether they are signed by members of the same group. We notice that the parameterαi,1,βi,1,…,αi,Vi,βi,Vi for each wireless terminal in the threshold signature is randomly generated and is used in such a way that the signature is updated once, so this scheme satisfies the non-association.


#### 4.1.5. Exculpability Analysis

As can be seen from the above, this group signature scheme is unforgeable. Thus, it is not feasible to forge a legitimate signature node if the other nodes except the signature node do not have the group member key. Therefore, this scheme is nonframeabal.


#### 4.1.6. Coalition-Resistance Analysis

As can be seen from the above study, this group signature scheme is unforgeable, when TMC wants to collaborate with nodeN1,….,Nl to generate a valid group signature of node Nl+1. The K-CAA difficulty problem assumes that P/s+xl+1 cannot be obtained by P/s+xl,…,P/s+xl, so the group administrator Opener cannot forge the group signature of Nl+1.


#### 4.1.7. Forward Security Analysis

When a member is revoked, the public and private keys of the revoked group memberGNi are made public in the revocation list. Suppose that an adversary can derive the identity of the group member to which the signature corresponds from A=T3−ξ1T1+ξ2T2. By the freshness of T1,T2, let vT1=T2, and set T1,T2 generated in k+1-th interactions as T,α+βT,….,α+βk−1T,α+βkT. After observing the previous k signature, the adversary deduces it from the k+1-th signature, and T1=T=α+βk+cT is set to solve the s-CDH problem.In summary, the scheme proposed in this section can effectively protect the concealment of group membership, with forward security, unforgeability and traceability, and can resist collusion attack and frame attack. Simultaneously, the scheme’s group signature length is short, which can effectively reduce the communication and computing overhead of the terminal and is more practical.


### 4.2. Efficiency Analysis

In order to prove that this scheme is more suitable for wireless terminals, it will be compared with other schemes. Table1 shows the time complexity of each operation, and literature is referred to the comparison data, where P is bilinear pair operation, S is the scalar multiplication operation on elliptic curves, A is the addition of two elliptic curve points, E is the power multiplication operation, and M is the point multiplication operation.Table 1
Time complexity of each operation [31].
OperationTime complexityScalar multiplication operationS1S ≈ 29MAddition of pointsA1A ≈ 0.11MBilinear pair operationP1P ≈ 87MPower multiplication operationE1E ≈ 21MHASHhIgnoreOne of the features of this scheme is the use of weighted thresholds instead of ordinary thresholds to accomplish threshold group signatures. Weighted thresholds are better suited for edge computing and the inequality of status between nodes in a blockchain. Table2 presents a comparison of the time complexity of the signature phase for a single wireless endpoint between this scheme and other thresholds for group signatures, where V0 represents the average weight value of the nodes of the blockchain. From Table 2, it can be seen that the larger the difference in weight values between the nodes, the lower the complexity of the signature computation in this scheme. Considering that the credibility of blockchain nodes varies greatly in reality, the scheme is applicable to the blockchain technology for wireless networks.Table 2
The computational complexity of this solution compared to other solutions for the same threshold.
SchemeScheme [25]SchemeScheme [27]This schemeComputational complexitykOEkOEkOEk/V0OS+EThe literature [32] tested the number multiplication time on the elliptic curve on a 900 KHz sensor to be about 2.6 s, and the number multiplication time on the elliptic curve is to be about 0.00195 s considering the latest CortexA9 1.2 GHz microprocessor for smart terminals. In order to better investigate the impression of edge computing on the blockchain identity privacy scheme, this paper presents a performance comparison between this scheme and a single node with a threshold group signature without edge computing. From Table 3, it can be seen that the edge computing offload optimizes the computational structure of the original signature scheme and greatly improves the computational efficiency of the blockchain endpoints.Table 3
The impact of offloading on the signature scheme.
SchemeComputational complexityTotal time spentTime (s)This scheme4S + A4S ≈ 116.11M0.0078Scheme3P + 9S + 3E + 3A3P + 9S + 3E + 3A ≈ 585.33M0.039


## 4.1. Security Analysis

The presented scheme is the threshold of typical group signature scheme, and its security is mainly determined by the original group signature scheme and threshold scheme. The unforgeability and anonymity of the original ring proof scheme have been proved [28]. Therefore, the following study will focus on the analysis of the impact of the weighted threshold.


### 4.1.1. Unforgeability

In this weighted threshold scheme, if all nodes distribute their own keys for the second time so that after distribution, each member of the group only holds one key segment, the node that originally held the key performs key security reimbursement then, this scheme becomes a typical verifiable threshold scheme [29]. According to the characteristics of threshold, any node combination whose weight sum is less than the threshold cannot complete the signature, and any node combination whose weight sum is higher than or equal to the threshold can complete the signature. Thus, the mentioned scheme can resist the collusion attack of any member whose credibility sum is less than the threshold.


### 4.1.2. Anonymity Analysis

Anonymity of signature means that for a given group signature, only TMC, the group administrator, can open the signature and trace the real signature member. With the introduction of threshold signature, the signature completed by a single group member in the original scheme is expanded to be signed jointly by multiple wireless terminals. The threshold signature in this paper is based on the principle of zero-knowledge proof that does not disclose the relevant information of the private key in the signature process. According to the characteristics of group signature [30], only the group administrator Issuer can open the signature, which shows that this scheme satisfies anonymity.


### 4.1.3. Traceability Analysis

TMC can trace the identity of a group member that generated the signature by performing the following operations:(1)
Execute the signature verification algorithm to ensure that the signature is a correct group signature for messagem(2)
CalculateA=T3−ξ1T1+ξ2T2 to check the correspondence table between Ai and group membership, thereby to determine the identity of the group member that produced the signature


### 4.1.4. Unlinkability Analysis

It is said to be uncorrelated if there are two signatures, satisfying the requirement that only the TMC can identify whether they are signed by members of the same group. We notice that the parameterαi,1,βi,1,…,αi,Vi,βi,Vi for each wireless terminal in the threshold signature is randomly generated and is used in such a way that the signature is updated once, so this scheme satisfies the non-association.


### 4.1.5. Exculpability Analysis

As can be seen from the above, this group signature scheme is unforgeable. Thus, it is not feasible to forge a legitimate signature node if the other nodes except the signature node do not have the group member key. Therefore, this scheme is nonframeabal.


### 4.1.6. Coalition-Resistance Analysis

As can be seen from the above study, this group signature scheme is unforgeable, when TMC wants to collaborate with nodeN1,….,Nl to generate a valid group signature of node Nl+1. The K-CAA difficulty problem assumes that P/s+xl+1 cannot be obtained by P/s+xl,…,P/s+xl, so the group administrator Opener cannot forge the group signature of Nl+1.


### 4.1.7. Forward Security Analysis

When a member is revoked, the public and private keys of the revoked group memberGNi are made public in the revocation list. Suppose that an adversary can derive the identity of the group member to which the signature corresponds from A=T3−ξ1T1+ξ2T2. By the freshness of T1,T2, let vT1=T2, and set T1,T2 generated in k+1-th interactions as T,α+βT,….,α+βk−1T,α+βkT. After observing the previous k signature, the adversary deduces it from the k+1-th signature, and T1=T=α+βk+cT is set to solve the s-CDH problem.In summary, the scheme proposed in this section can effectively protect the concealment of group membership, with forward security, unforgeability and traceability, and can resist collusion attack and frame attack. Simultaneously, the scheme’s group signature length is short, which can effectively reduce the communication and computing overhead of the terminal and is more practical.


## 4.1.1. Unforgeability

In this weighted threshold scheme, if all nodes distribute their own keys for the second time so that after distribution, each member of the group only holds one key segment, the node that originally held the key performs key security reimbursement then, this scheme becomes a typical verifiable threshold scheme [29]. According to the characteristics of threshold, any node combination whose weight sum is less than the threshold cannot complete the signature, and any node combination whose weight sum is higher than or equal to the threshold can complete the signature. Thus, the mentioned scheme can resist the collusion attack of any member whose credibility sum is less than the threshold.


## 4.1.2. Anonymity Analysis

Anonymity of signature means that for a given group signature, only TMC, the group administrator, can open the signature and trace the real signature member. With the introduction of threshold signature, the signature completed by a single group member in the original scheme is expanded to be signed jointly by multiple wireless terminals. The threshold signature in this paper is based on the principle of zero-knowledge proof that does not disclose the relevant information of the private key in the signature process. According to the characteristics of group signature [30], only the group administrator Issuer can open the signature, which shows that this scheme satisfies anonymity.


## 4.1.3. Traceability Analysis

TMC can trace the identity of a group member that generated the signature by performing the following operations:(1)
Execute the signature verification algorithm to ensure that the signature is a correct group signature for messagem(2)
CalculateA=T3−ξ1T1+ξ2T2 to check the correspondence table between Ai and group membership, thereby to determine the identity of the group member that produced the signature


## 4.1.4. Unlinkability Analysis

It is said to be uncorrelated if there are two signatures, satisfying the requirement that only the TMC can identify whether they are signed by members of the same group. We notice that the parameterαi,1,βi,1,…,αi,Vi,βi,Vi for each wireless terminal in the threshold signature is randomly generated and is used in such a way that the signature is updated once, so this scheme satisfies the non-association.


## 4.1.5. Exculpability Analysis

As can be seen from the above, this group signature scheme is unforgeable. Thus, it is not feasible to forge a legitimate signature node if the other nodes except the signature node do not have the group member key. Therefore, this scheme is nonframeabal.


## 4.1.6. Coalition-Resistance Analysis

As can be seen from the above study, this group signature scheme is unforgeable, when TMC wants to collaborate with nodeN1,….,Nl to generate a valid group signature of node Nl+1. The K-CAA difficulty problem assumes that P/s+xl+1 cannot be obtained by P/s+xl,…,P/s+xl, so the group administrator Opener cannot forge the group signature of Nl+1.


## 4.1.7. Forward Security Analysis

When a member is revoked, the public and private keys of the revoked group memberGNi are made public in the revocation list. Suppose that an adversary can derive the identity of the group member to which the signature corresponds from A=T3−ξ1T1+ξ2T2. By the freshness of T1,T2, let vT1=T2, and set T1,T2 generated in k+1-th interactions as T,α+βT,….,α+βk−1T,α+βkT. After observing the previous k signature, the adversary deduces it from the k+1-th signature, and T1=T=α+βk+cT is set to solve the s-CDH problem.In summary, the scheme proposed in this section can effectively protect the concealment of group membership, with forward security, unforgeability and traceability, and can resist collusion attack and frame attack. Simultaneously, the scheme’s group signature length is short, which can effectively reduce the communication and computing overhead of the terminal and is more practical.


## 4.2. Efficiency Analysis

In order to prove that this scheme is more suitable for wireless terminals, it will be compared with other schemes. Table1 shows the time complexity of each operation, and literature is referred to the comparison data, where P is bilinear pair operation, S is the scalar multiplication operation on elliptic curves, A is the addition of two elliptic curve points, E is the power multiplication operation, and M is the point multiplication operation.Table 1
Time complexity of each operation [31].
OperationTime complexityScalar multiplication operationS1S ≈ 29MAddition of pointsA1A ≈ 0.11MBilinear pair operationP1P ≈ 87MPower multiplication operationE1E ≈ 21MHASHhIgnoreOne of the features of this scheme is the use of weighted thresholds instead of ordinary thresholds to accomplish threshold group signatures. Weighted thresholds are better suited for edge computing and the inequality of status between nodes in a blockchain. Table2 presents a comparison of the time complexity of the signature phase for a single wireless endpoint between this scheme and other thresholds for group signatures, where V0 represents the average weight value of the nodes of the blockchain. From Table 2, it can be seen that the larger the difference in weight values between the nodes, the lower the complexity of the signature computation in this scheme. Considering that the credibility of blockchain nodes varies greatly in reality, the scheme is applicable to the blockchain technology for wireless networks.Table 2
The computational complexity of this solution compared to other solutions for the same threshold.
SchemeScheme [25]SchemeScheme [27]This schemeComputational complexitykOEkOEkOEk/V0OS+EThe literature [32] tested the number multiplication time on the elliptic curve on a 900 KHz sensor to be about 2.6 s, and the number multiplication time on the elliptic curve is to be about 0.00195 s considering the latest CortexA9 1.2 GHz microprocessor for smart terminals. In order to better investigate the impression of edge computing on the blockchain identity privacy scheme, this paper presents a performance comparison between this scheme and a single node with a threshold group signature without edge computing. From Table 3, it can be seen that the edge computing offload optimizes the computational structure of the original signature scheme and greatly improves the computational efficiency of the blockchain endpoints.Table 3
The impact of offloading on the signature scheme.
SchemeComputational complexityTotal time spentTime (s)This scheme4S + A4S ≈ 116.11M0.0078Scheme3P + 9S + 3E + 3A3P + 9S + 3E + 3A ≈ 585.33M0.039


## 5. Conclusion

In the current work, a privacy-preserving approach using a weighted gating group signature scheme is proposed given the complexity of previous blockchain privacy protection schemes, which is difficult to be applied to blockchain nodes in the form of wireless terminals. This scheme effectively offloads the computational complexity of blockchain terminals by using edge computing nodes, which ensures the identity privacy of blockchain nodes and reduces the computational burden of wireless terminals. The characteristic of threshold makes the scheme resist the collusion attack of members whose credibility sum is less than the threshold, which further improves the security of the scheme.



---

*Source: 4559119-2022-03-23.xml*