摘要： 目前大多数的唯一环签名(URS)方案基于离散对数问题，仅有Nguyen和王俊卉提出的URS能够满足后量子安全性。然而，这些方案各有局限：Nguyen的方案使用零知识证明导致计算资源消耗大，而王俊卉的方案则因格基结构的设计使密钥长度较长，增加了存储开销。此外，两种方案均依赖数字证书管理公钥，需要存储和管理大量的证书文件，进一步增加了系统的存储和管理成本。为此，本文提出了一个NTRU格上基于身份的高效URS方案。首先，利用NTRU格密码体制公私钥长度较短的特性，减少密钥存储开销；其次，采用紧凑高斯采样算法生成用户私钥，以提高密钥生成效率；最后，通过引入身份基机制构造公钥，从而消除对证书的依赖。安全性分析表明，该方案在随机预言机模型(ROM)下具有无条件匿名性、不可伪造性和唯一性，其安全性可归约到NTRU格上的小整数解问题。性能分析表明，与现有的基于格的URS方案相比，该方案具有较短的公钥长度和更低的计算开销，在签名生成和验证时间开销上平均分别减少了约15%和13%。

Abstract: Currently, most Unique Ring Signature (URS) schemes are based on the discrete logarithm problem. Among them, only the URS scheme proposed by Nguyen and Junhui Wang satisfies post-quantum security requirements. However, each of these schemes has its limitations: Nguyen's scheme utilizes zero-knowledge proofs, which results in significant computational resource consumption, while Junhui Wang's scheme leads to longer key lengths due to the design of the lattice-based structure, increasing storage overhead. In addition, both schemes rely on digital certificates to manage public keys, requiring the storage and management of a large number of certificate files, further increases the storage and management costs of the system. To address these challenges, this paper proposes an efficient identity-based URS scheme over the NTRU lattice. First, by leveraging the relatively short public and private key lengths of the NTRU lattice cryptosystem, the scheme reduces key storage overhead. Second, a compact Gaussian sampling algorithm is employed to generate user private keys, thereby improving key generation efficiency. Finally, an identity-based mechanism is introduced to construct public keys, eliminating the reliance on digital certificates. Security analysis demonstrates that, under the Random Oracle Model (ROM), the proposed scheme achieves unconditional anonymity, unforgeability, and uniqueness, with its security reducible to the small integer solution problem on the NTRU lattice. Performance analysis shows that, compared to existing lattice-based URS schemes, this approach offers shorter public key lengths and lower computational overhead, with average reductions of about 15% and 13% in signature generation and verification time, respectively.