Ring signatures in ECC Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret agreement (ECDH for example) with elliptic curves. That doesn't seem to be adequate to complete the ring - don't you need invertibility?
As suggested, here is a hopefully entry-level precis of the paper linked in the comment above.
A Discrete Logarithm based asymmetric key system lacks a true trapdoor function - you can't compute a pre-image for an arbitrary image. Instead, a Schnorr signature relies on a slightly weaker condition. A generalized Schnorr signature can be considered to have two parts:

a function $O_{K}(i, s)$ taking public key, $K$, an input $i$ and a signature $s$. In ECC, the main component of $O_K(i,s)$ is a bit representation of $s\cdot G+i\cdot K$, where $G$ is the canonical generator for the ECC group and $x\cdot h$ is multiplication of the curve point $h$ by the scalar $x$. Other data may be appended to this bit representation, such as the message to be signed and the list of candidate keys in the ring signature. Generally, it must contain enough information to precisely specify the claim the signature is intended to prove, so that the signature can't be replayed in any other context.
a hash function $H(o, m)$ which takes $o$, any output of $O$, and $m$, the message to be authenticated.

$O$ has the additional property that, knowing the secret key corresponding to $K$, it is possible to construct arbitrarily many $o'$ where it is possible to find $s$ for any given $i$ s.t. $o' = O(i, s)$. i.e. there are specific outputs where we can solve for the signature given any input. Call this a preimageable output.
In a standard Schnorr signature we...

construct such a preimageable output $o'$ and pass to $H$
take $i = H(o', m)$ and solve for $s$.
Our signature is $(i, s)$

We verify by checking $i = H( O_{K}(i, s), m )$, i.e. that the input to $O$ is equal to the output of $H$.
Assuming we know the secret key for $K_{1}$ in a set of $K_{1 ... n}$ public keys, we can construct a ring signature as follows:

Construct $o'_{1}$, a preimageable output of $O_{K_{1}}$
Calculate $i_{1} = H(o'_{1}, m)$
Calculate each $i_{j+1} = H( O_{K_{j}}(i_{j}, s_{j}), m )$ for a randomly chosen $s_{j}$
Finally, with $i_{1} = i_{n+1}$ solve $o' = O_{K_{1}}(i_{1}, s_{1})$ for $s_{1}$

The ring signature is the sequence of $(i_{j}, s_{j})$ and is verified by checking that for a chosen $i_{j}$ a round-trip of the ring gives the starting value.
The actual construction is a little more complex. The hash includes the complete set of public keys, for example. But this should give the idea of how it works.