Data transaction security and privacy protection method based on zero-knowledge proof smart contract

Abstract

The invention relates to a data transaction security and privacy protection method based on a zero-knowledge proof smart contract. The method comprises the following steps: initializing block chain parameters; the seller and the purchaser register privacy identities with the credible supervision mechanism; a seller generates an ownership relationship of data to be sold and a zero-knowledge proof of a data ownership proof contract, links {alpha, # imgabs0 # T1, sign1}, and obtains an address on the link; the seller generates a zero-knowledge proof for preventing the machinability attack contract, verifies the zero-knowledge proof according to the uplink information, and releases information of the data to be sold after the zero-knowledge proof passes the verification; the method comprises the following steps: a purchaser requests purchase data from a seller, the purchaser generates a zero-knowledge proof of a data ownership privacy transfer proof contract according to a new ownership relationship calculated by the seller, verifies the zero-knowledge proof, obtains a ciphertext storage address of the purchase data, and links {alpha, # imgabs1 # T2, AddrMnew, add and sign2}. The method has better security and privacy characteristics.

Description

Technical Field

[0001] The present invention relates to the technical field of data security and privacy protection, and in particular to a data transaction security and privacy protection method based on zero-knowledge proof smart contracts. Background Art

[0002] The data trading market plays an important role in data trading. It can provide data trading participants with services such as data hosting, transaction matching, and demand matching to help data providers and data consumers complete data transactions quickly and effectively. The security and privacy protection of data transactions should meet the following requirements:

[0003] (1) Identity privacy protection: The real identities of the data owner and buyer are private and secure, and the data transaction process will not disclose the real identity information of either party.

[0004] (2) Data privacy protection: Data should not be stored and circulated in the trading market in plain text.

[0005] (3) Protection of data ownership: Data transactions should include the transfer of data ownership, and during the data life cycle, the ownership of the data should be confirmed and traced to protect the rights and interests of the data owner. In addition, data ownership is usually bound to identity. In order to be compatible with identity privacy protection, the confirmation and tracing of data ownership should not disclose the identity of the owner and buyer (privacy confirmation and tracing).

[0006] (4) Privacy protection of commercial activities: Except for the data owner and the data buyer, no one can know to whom the ownership of the data is transferred after the transaction.

[0007] (5) The transaction process is secure and reliable: Transaction services should be open and transparent, and be traceable, auditable and controllable.

[0008] In recent years, various security and privacy protection methods have been proposed to achieve the security and privacy protection of data transactions. For example, homomorphic encryption and signature verification mechanisms are used to protect the bid privacy and identity privacy of consumers in the data transaction process. Ring signatures and similarity learning are used to protect the identity privacy of participants. However, these traditional methods are mostly based on centralized architectures, which makes it difficult to ensure the decentralized security and transparency of transactions and the traceability of behaviors and ownership. Therefore, decentralized data transaction security and privacy protection systems based on blockchain have also been proposed one after another, such as a secure data transaction ecosystem based on blockchain and software guard extension (SGX). This system places data processing operations in an open and transparent blockchain smart contract, but in order to protect the security of the original data, the Ethereum virtual machine that executes the smart contract is placed in the SGX environment, and the privacy security of the transaction process is ensured through privacy computing. Buyers cannot directly access the original data and can only obtain the processed results.

[0009] Although existing decentralized solutions have improved security and privacy protection compared to centralized secure and private transaction solutions, no research has fully considered the above five challenges. Summary of the invention

[0010] The purpose of the present invention is to provide a data transaction security and privacy protection method based on zero-knowledge proof smart contracts, introduce zero-knowledge proof smart contracts that can be executed on the chain, and combine Merkle Tree Proof of Reserves (MTPR), proxy re-encryption, and tamper-proof and traceable blockchain distributed ledgers to construct a data transaction security and privacy method based on zero-knowledge proof smart contracts.

[0011] To achieve the above object, the present invention provides the following solutions:

[0012] Data transaction security and privacy protection methods based on zero-knowledge proof smart contracts include:

[0013] Initialize blockchain parameters;

[0014] The seller and the buyer request to register a private identity with the trusted regulatory agency, and the trusted regulatory agency verifies the private identity and signs the verified private identity and returns it to the seller and the buyer;

[0015] The seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, encrypts and stores the data to be sold, and obtains a ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to the trusted regulatory agency for verification. After the verification is passed, the first target information is uploaded to the chain and the address on the chain is obtained;

[0016] The seller generates a zero-knowledge proof of the contract to prevent processability attacks, and requests the data market to publish the information of the data to be sold. The data market verifies the zero-knowledge proof of the contract to prevent processability attacks based on the first target information on the chain. After the verification is passed, the data market publishes the information of the data to be sold;

[0017] The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification, the purchase data is encrypted and stored, the ciphertext storage address of the purchase data is obtained, and the second target information is uploaded to the chain, wherein the first target information is The second target information is α is the unique identifier of the original data, i.e. the data to be sold m, Data ownership R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain, and sign1 is The signature of addr id is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer. sign.

[0018] Optionally, the seller requests a trusted regulatory agency to register a privacy identity, and the trusted regulatory agency verifies the privacy identity including:

[0019] The seller generates a seller private key and a seller public key;

[0020] The seller generates a seller random number and a random number to prevent processability attacks, and calculates a hash value of the seller's privacy identity and the random number to prevent processability attacks;

[0021] The seller's private identity is used as a public input, the seller's private key and the seller's random number are used as private inputs, and a zero-knowledge proof of the seller's private identity proof contract is generated based on the proof key;

[0022] The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's private identity certification contract, and the hash value of the random number to prevent processability attacks to the trusted regulatory agency to request registration of the private identity;

[0023] The trusted regulatory agency proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity certification contract.

[0024] Optionally, the seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, including:

[0025] The seller obtains hash values ​​of the data to be sold multiple times to uniquely identify the data to be sold;

[0026] The unique identifier of the data to be sold and the private identity of the seller are hashed to obtain the ownership relationship;

[0027] Constructing a Merkle hash tree with the ownership relationship as a leaf node, and calculating the root of the Merkle hash tree and auxiliary authentication information of the leaf node;

[0028] The seller's private identity, the root of the Merkle hash tree and the unique identifier of the data to be sold are used as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree and the hash value of the data to be sold are used as private inputs, and a zero-knowledge proof of the data ownership proof contract is generated based on the proof key.

[0029] Optionally, encrypting and storing the data to be sold, and obtaining the ciphertext hash address includes:

[0030] Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key;

[0031] The sales data is encrypted using the seller's re-encryption public key to obtain the ciphertext and store it in a distributed storage system to obtain the ciphertext hash address.

[0032] Optionally, the seller generates a zero-knowledge proof of the contract to prevent processability attacks, including:

[0033] The seller will use the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold and the hash value of the random number to prevent machinability attacks as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent machinability attacks and the hash value of the data to be sold as private inputs, and generate a zero-knowledge proof of the contract to prevent machinability attacks based on the proof key.

[0034] Optionally, the data market verifies the zero-knowledge proof of the contract for preventing processability attacks according to the first target information on the chain, including:

[0035] The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the contract for preventing processability attacks, searches for the first target information corresponding to the latest timestamp on the chain, and verifies the validity of sign1 using the public key of the trusted regulatory agency;

[0036] After the verification is passed, the trusted regulatory agency calls the zero-knowledge proof of the contract to prevent processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

[0037] Optionally, the purchaser requests the seller to purchase data including:

[0038] The buyer's private identity is used as a public input, the buyer's private key and the buyer's random number are used as private inputs, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key;

[0039] The buyer's private key and public key are re-encrypted by proxy, and the buyer sends the buyer's public key re-encrypted by proxy, the zero-knowledge proof of the buyer's privacy identity certification contract, and the signature of the buyer's privacy identity to the seller, requesting to purchase the data;

[0040] The seller invokes the zero-knowledge proof of the privacy identity certification contract and uses the public key of the trusted regulatory agency to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of a privacy identity registered with the trusted regulatory agency.

[0041] Optionally, the buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, including:

[0042] The seller calculates the new ownership relationship based on the private identity of the buyer and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node;

[0043] The seller sends the new ownership relationship, the new Merkle tree root and the auxiliary authentication information of the leaf node to the buyer;

[0044] The buyer takes the root of the Merkle hash tree, the new Merkle tree root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as privacy input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

[0045] Optionally, the trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract, and encrypts and stores the purchased data after the verification, including:

[0046] The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key;

[0047] The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency, and the trusted regulatory agency calls the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold, and at the same time verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity, and generates a new ownership relationship;

[0048] After the verification is passed, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address;

[0049] The ciphertext is converted into a new ciphertext using the proxy re-encryption key, stored in a distributed storage system, and a new ciphertext hash address is obtained.

[0050] Optionally, the second target information is uploaded to the chain to form an evidence chain for ownership tracing Used for ownership tracing and auditing.

[0051] The beneficial effects of the present invention are as follows: the present invention provides a decentralized data transaction security and privacy protection method based on zero-knowledge proof, proxy re-encryption and blockchain technology, aiming to solve the problems of identity privacy leakage of participants in data transactions, privacy leakage of transaction data, difficulty in confirming and tracing the ownership of transaction data, privacy leakage of transaction business behavior, lack of trust in the transaction process, etc. First, the present invention utilizes the one-way and anti-collision characteristics of hash functions and the Merkle tree reserve proof to effectively realize the management and existence proof of a large number of leaf nodes, constructs identity privacy proof, ownership privacy confirmation, and ownership privacy transfer smart contracts based on the Groth16 zero-knowledge proof algorithm, and realizes the privacy protection of the identity on the chain, the privacy confirmation of ownership, and the privacy protection of transaction business behavior based on these open and transparent smart contracts, ensuring the security and reliability of the transaction process. Secondly, the present invention introduces proxy re-encryption in the data transaction process, and combines the unalterable and traceable characteristics of the blockchain distributed ledger to encrypt the transaction data, and constructs a tracking evidence chain of relevant privacy ownership information, realizing the privacy protection of transaction data and the tracing of ownership. Thirdly, the present invention considers the processability attack problem of the Groth16 zero-knowledge proof algorithm, constructs a smart contract that resists processability attacks, avoids the processability attack problem in the ownership privacy confirmation process, and further ensures data transaction and privacy security (compared to the current research on zero-knowledge proof using Groth16, the present invention considers the processability attack problem for the first time and has better security). Finally, the present invention proves that the proposed method meets the requirements of identity privacy protection, transaction data privacy protection, transaction data ownership protection, transaction business behavior privacy protection, and transaction process security and reliability, and evaluates that the method has low on-chain computing overhead and storage overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 This is a flow chart of a data transaction security and privacy protection method based on a zero-knowledge proof smart contract according to an embodiment of the present invention;

[0054] Figure 2 A statistical graph of gas consumption for different smart contracts deployed in an embodiment of the present invention;

[0055] Figure 3 Execution time statistics of different smart contracts according to the embodiment of the present invention;

[0056] Figure 4 A statistical graph of gas consumption for execution of different smart contracts according to an embodiment of the present invention;

[0057] Figure 5 It is a storage cost graph on the chain of ownership tracing evidence chain in an embodiment of the present invention;

[0058] Figure 6 A comparison chart of the execution time consumed by two transactions in an embodiment of the present invention;

[0059] Figure 7 A comparison chart of smart contract execution consumption between the method of the embodiment of the present invention and two existing methods;

[0060] Figure 8 A comparison chart of smart contract execution time between the method of the embodiment of the present invention and two existing methods;

[0061] Fig. 9 The present invention is a flowchart of Zokrates completing zero-knowledge proof. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0064] This embodiment provides a data transaction security and privacy protection method based on zero-knowledge proof smart contract, including:

[0065] Initialize blockchain parameters;

[0066] The seller and the buyer request to register the private identity with the trusted regulatory agency. The trusted regulatory agency verifies the private identity and signs the verified private identity and returns it to the seller and the buyer.

[0067] The seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, encrypts and stores the data to be sold, and obtains the ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to the trusted regulatory agency for verification. After the verification is passed, the first target information is uploaded to the chain and the address on the chain is obtained;

[0068] The seller generates a zero-knowledge proof of the contract to prevent machinability attacks and requests the data market to publish the information of the data to be sold. The data market verifies the zero-knowledge proof of the contract to prevent machinability attacks based on the first target information on the chain. After the verification is passed, the data market publishes the information of the data to be sold;

[0069] The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification, the purchased data is encrypted and stored, the ciphertext storage address of the purchased data is obtained, and the second target information is uploaded to the chain. The first target information is The second target information is α is the unique identifier of the original data, i.e. the data to be sold m, For R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain. The signature of addr id is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer, sign2 is sign.

[0070] Specifically, the method proposed in this embodiment includes: 4 entity roles, blockchain smart contracts, data ownership tracking evidence chain, interplanetary file system IPFS, and data ownership management Merkle hash tree.

[0071] Entity roles:

[0072] (1) Seller: The seller is the provider of data, and will sell data through the data trading market. In order to protect identity privacy, the seller will hide the real identity through zero-knowledge proof; in order to protect data privacy, the seller will use proxy re-encryption to encrypt the data; in order to protect data ownership, the seller will manage data ownership through Merkle hash tree, and combine zero-knowledge proof and blockchain distributed ledger to confirm and trace ownership privacy; in order to protect commercial privacy, the seller will use zero-knowledge proof to transfer data ownership privacy, while hiding the identity of the data buyer.

[0073] (2) Buyers: Buyers are data demanders who will use the data market to discover and purchase data. Buyers will also hide their true identities through zero-knowledge proofs and conduct transactions based on their private identities. In addition, after obtaining ownership of the data, buyers can also become sellers and sell the purchased data through the data market.

[0074] (3) Trusted regulatory agency: This embodiment assumes that the trusted regulatory agency is an honest and credible authority. It will act as a trust root to sign and endorse the privacy traceability information and store the signed and endorsed information in an unalterable blockchain distributed ledger. In order to achieve privacy traceability and the security and trustworthiness (regulatory) of the transaction process, the trusted regulatory agency can trace and audit the privacy identities of the seller and buyer, the previous transfer of data ownership (the current ownership transfer cannot be known to anyone other than the seller and buyer), etc.

[0075] (4) Data Market: The data market mainly publishes data description information for sellers and matches the required data for buyers. It does not participate in direct data transactions. Operations related to data transactions and ownership transfer are completed in an open and transparent blockchain to ensure the security and reliability of transactions.

[0076] Blockchain Smart Contracts:

[0077] This embodiment will be based on Figure 1 The four smart contracts shown complete the on-chain public trusted verification of zero-knowledge proof, and the five smart contracts are generated by the arithmetic circuit constraint equations shown in Algorithms 2 to 5. The specific contracts include:

[0078] (1) Privacy identity proof contract PriIDHolderSc. This contract can prove the holder of the privacy identity (privacy public key) without revealing the private key. The corresponding constraint equation is Algorithm 2.

[0079] (2) Data ownership proof contract PriOwnerSc. This contract can prove the privacy identity (privacy public key) and the owner of the data (privacy confirmation of data) without revealing the private key and data ownership related authentication information (ownership management Merkle hash tree auxiliary authentication information). The corresponding constraint equation is Algorithm 3.

[0080] (3) Data ownership privacy transfer proof contract PriAuthorizeSc. This contract can prove that the data ownership has been transferred to the buyer without revealing the buyer's privacy identity (private transfer of data ownership to protect the privacy of commercial behavior). The corresponding constraint equation is Algorithm 4.

[0081] (4) Preventing processability attacks on the contract PriOwner1Sc. This contract is used to prevent processability attacks on the Groth16 zero-knowledge proof. Because for the Groth16 zero-knowledge proof algorithm, although it meets zero-knowledge, completeness and reliability, there are processability attacks, that is, an attacker who has seen a valid zero-knowledge proof π can forge a different, but still valid zero-knowledge proof π'. In other words, if a zero-knowledge proof needs to be verified more than twice in a smart contract, a processability attack may occur during the verification process. Since this embodiment needs to verify the ownership of the same data twice, this embodiment constructs a zero-knowledge proof smart contract with different public inputs from the data ownership proof contract PriOwnerSc to prevent processability attacks.

[0082] Interplanetary File System IPFS: In order to ensure the security and privacy of data, the transaction data of this embodiment will be stored in the distributed Interplanetary File System IPFS in ciphertext form (proxy re-encrypted ciphertext), and the ciphertext hash address will be obtained. At the same time, the ciphertext hash address will be stored in the blockchain distributed ledger by the trusted regulatory agency to ensure the credibility of the data.

[0083] Data ownership management Merkle hash tree:

[0084] In this embodiment, data ownership is represented as the binding relationship R between the unique identifier α of the data and the privacy identity (privacy public key) of the data owner pkpri-Seller α =h(pk pri ||α). At the same time, the binding relationship will be used as a leaf node to construct a data ownership management Merkle hash tree. Based on this structure, each seller can create a Merkle hash tree to manage data ownership and do not disclose the specific binding relationship R α and auxiliary authentication information In the case of data ownership transfer, it proves that the data is owned by the holder. On the other hand, after the data ownership is transferred, the binding relationship will change. Bα =h(pk B pri||α), but auxiliary authentication information No change, at this time, it is necessary to use the new binding relationship and auxiliary authentication information Calculate the new tree root and complete the proof of data ownership.

[0085] Furthermore, the seller requests the trusted regulatory agency to register the privacy identity, and the trusted regulatory agency verifies the privacy identity including:

[0086] The seller generates a seller private key and a seller public key;

[0087] The seller generates a seller random number and a random number to prevent processability attacks, and calculates the hash value of the seller's privacy identity and the random number to prevent processability attacks;

[0088] The seller's private identity is used as a public input, and the seller's private key and the seller's random number are used as private inputs. Based on the proof, the key generates a zero-knowledge proof of the seller's private identity proof contract;

[0089] The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's privacy identity certification contract, and the hash value of the random number to prevent processability attacks to the trusted regulatory agency to request registration of the privacy identity;

[0090] The trusted regulator proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity contract.

[0091] Specifically, all sellers and buyers who intend to participate in data sales and purchases need to register their privacy identities with a trusted regulatory agency. pri-Seller ,pk pri-Buyer The trusted regulatory agency will verify the private identity and sign the verified private identity. Re (pk pri-Seller ),sig Re (pk pri-Buyer ), and then returns to the seller and the buyer to indicate that the private identity registration is successful. This embodiment assumes that the regulatory agency is trustworthy and knows the private identity pk pri-Seller ,pk pri-Buyer The corresponding real identity pk Seller ,pk Buyer , for ownership tracing and auditing, etc. However, the trusted regulatory agency cannot know to whom the current seller has transferred the data ownership, thus protecting the privacy of commercial activities.

[0092] Furthermore, the seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, including:

[0093] The seller performs multiple hash calculations on the data to be sold to uniquely identify the data to be sold;

[0094] The unique identifier of the data to be sold and the seller's private identity are hashed to obtain the ownership relationship;

[0095] Construct a Merkle hash tree with the ownership relationship as the leaf node, and calculate the root of the Merkle hash tree and the auxiliary authentication information of the leaf node;

[0096] The seller's private identity, the root of the Merkle hash tree and the unique identifier of the data to be sold are taken as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree and the hash value of the data to be sold are taken as private inputs, and a zero-knowledge proof of the data ownership proof contract is generated based on the proof key.

[0097] In this embodiment, the data seller generates the ownership relationship R of the data m to be sold. α And zero-knowledge proof of data ownership π Owner (This zero-knowledge proof can prove that it is a private identity without revealing the real identity pri-Seller and data ownership R α The Merkle tree reserve proof algorithm is shown in Algorithm 1 in Table 1.

[0098] Table 1

[0099]

[0100] Furthermore, the data to be sold is encrypted and stored, and the ciphertext hash address is obtained including:

[0101] Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key;

[0102] The selling data is encrypted using the seller's re-encryption public key, the ciphertext is obtained and stored in a distributed storage system, and the ciphertext hash address is obtained.

[0103] In this embodiment, the seller uses the proxy to re-encrypt the public key Ppk seller The data is encrypted to obtain the ciphertext M, and the data ciphertext M is stored in IPFS to obtain the IPFS storage address AddrM. The seller submits πOwner and AddrM to the trusted regulatory agency to prove the ownership relationship R α The owner of the The blockchain registration provides a basis for the credible proof of ownership in the subsequent data sales. After the credible regulatory agency verifies the validity of the πOwner, it obtains the current timestamp T1 and Signature sign1, and On the chain, get The on-chain address addr id .

[0104] Furthermore, the seller generates a zero-knowledge proof of the contract to prevent processability attacks, including:

[0105] The seller will use the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold, and the hash value of the random number to prevent processability attacks as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent processability attacks, and the hash value of the data to be sold as private inputs, and generate a zero-knowledge proof of the contract to prevent processability attacks based on the proof key.

[0106] In this embodiment, the seller generates a zero-knowledge proof of ownership of the data 1Owner (π Owner and π 1Owner has the same effect, but π 1Owner A public input parameter η is added to prevent machinability attacks)

[0107] Furthermore, the data market is based on the Verification of zero-knowledge proofs against processability attack contracts includes:

[0108] The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the contract to prevent processability attacks, and searches for the latest timestamp on the chain. Use the public key of the trusted regulatory agency to verify the validity of sign1;

[0109] After the verification is passed, the trusted regulator calls the zero-knowledge proof of the contract to prevent processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

[0110] In this embodiment, the data market is requested to publish information about the data m to be sold (the plain text of data m is not disclosed, and mainly the description information is published). Verify π 1Owner If the verification is successful, the data market will release the information that the seller intends to sell the data m.

[0111] Furthermore, the purchaser's request to the seller for purchase data includes:

[0112] The buyer's private identity is used as public input, the buyer's private key and the buyer's random number are used as private input, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key;

[0113] The buyer's private key and public key are re-encrypted by proxy, and the buyer sends the proxy-re-encrypted buyer's public key, the zero-knowledge proof of the buyer's privacy identity certification contract, and the signature of the buyer's privacy identity to the seller to request the purchase of data;

[0114] The seller calls the zero-knowledge proof of the privacy identity certification contract and uses the regulatory authority to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of a privacy identity registered with a trusted regulatory authority.

[0115] In this embodiment, the buyer matches the data to be purchased and the corresponding seller from the data market. The buyer proves to the seller that his privacy identity has been registered with a trusted regulatory agency and submits his proxy re-encryption public key Ppk B uyer, request the seller to transfer the privacy of data ownership (the transfer of ownership will not disclose the privacy identity of the buyer pkpri-Buyer).

[0116] Furthermore, the buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, including:

[0117] The seller calculates a new ownership relationship based on the buyer's private identity and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node;

[0118] The seller sends the new ownership relationship, the new Merkle tree root, and the auxiliary authentication information of the leaf nodes to the buyer;

[0119] The buyer takes the root of the Merkle hash tree, the new Merkle root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as privacy input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

[0120] In this embodiment, the seller is based on the buyer's private identity pk pri-Buyer , calculate the new ownership relationship R Bα , and generate zero-knowledge proof of ownership privacy transfer π Authri (π Authri Can pk without revealing the buyer's privacy identity pri-Buyer In the case of data ownership transfer, it is proved that the data ownership has been transferred, achieving the purpose of data ownership privacy transfer), and requesting the trusted regulatory agency to have the key information {α,rootR Bα}On the chain, and at the same time based on its proxy re-encrypted private key Psk Seller and the buyer's public key Ppk Buyer Generate a proxy re-encryption key ProxyKey and send it to the trusted regulatory agency, requesting the trusted regulatory agency to perform proxy re-encryption on the data ciphertext.

[0121] Furthermore, the trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract, and after the verification, encrypts and stores the purchased data, including:

[0122] The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key;

[0123] The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency. The trusted regulatory agency calls the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold. At the same time, it verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity and generates a new ownership relationship.

[0124] After verification, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address;

[0125] The proxy re-encryption key is used to convert the ciphertext into a new ciphertext, which is stored in the distributed storage system and the new ciphertext hash address is obtained.

[0126] Further, After being uploaded to the chain, it forms an evidence chain for tracing ownership Used for ownership tracing and auditing.

[0127] In this embodiment, the trusted regulatory agency verifies π Authri After the validity is verified, the data ciphertext is re-encrypted to generate the re-encrypted ciphertext M new , and store Mnew in IPFS to obtain the IPFS address AddrM new The trusted regulator obtains the current timestamp T2 and Signature sign2, Stored in the blockchain distributed ledger, forming a chain of evidence for ownership tracing It is convenient for ownership tracing and auditing. After the buyer obtains the privacy transfer of ownership, he can query AddrM on the chain. new , get the re-encrypted ciphertext M new , and based on its proxy re-encrypted private key Psk Buyer Decrypt M new Obtain plaintext m. The buyer obtains two hash values ​​of plaintext m and compares the result with α. If they are the same, it means that the correct privacy authorization has been obtained.

[0128] Example:

[0129] The key symbols and descriptions involved in this embodiment are shown in Table 2.

[0130] Table 2

[0131]

[0132]

[0133]

[0134] The data transaction security and privacy protection methods based on zero-knowledge proof smart contracts specifically include:

[0135] 1. Initialization:

[0136] First, construct the zero-knowledge proof arithmetic circuit constraint equations of Algorithms 2 to 5. The zero-knowledge proof arithmetic circuit constraint equations of smart contract PriIDHolderSc in Algorithm 2, the zero-knowledge proof arithmetic circuit constraint equations of smart contract PriOwnerSc in Algorithm 3, the zero-knowledge proof arithmetic circuit constraint equations of smart contract PriAuthorizeSc in Algorithm 4, and the zero-knowledge proof arithmetic circuit constraint equations of smart contract PriOwner1Sc in Algorithm 5 are shown in Table 3-6. Initialize and generate smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc. Secondly, execute the "setup" operation to generate 4 different Proving Keys and Verification Keys. Thirdly, generate 4 zero-knowledge proof smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc based on the Verification Key. Finally, deploy the smart contract and release the Proving Key to relevant participants.

[0137] Table 3

[0138]

[0139] Table 4

[0140]

[0141]

[0142] Table 5

[0143]

[0144] Table 6

[0145]

[0146]

[0147] 2. Privacy identity registration:

[0148] Step 1: First, the seller generates a private key sk S eller and public key pk S eller=h(sk S eller), the public key pk Seller As the only real identity; second, the seller generates a random number δ Seller and β, calculate the private identity (private public key) pk pri-Seller =h(pk seller ||δ Seller ) and η = h(β), where η will be used to prevent processability attacks (see Algorithm 5 for details); third, the seller uses pk pri-Seller is the common input, (sk Seller ,δSeller) is the privacy input, based on Algorithm 2 and the received ProvingKey, execute Fig. 9 The "Proof" operation in generates the zero-knowledge proof π of the seller's private identity proof contract PriIDH ={A PriDH ,B PriDH ,C PriDH ,PublicInputs=pk pri-seller}; Fourth, the seller submits pk to a trusted authority Seller ,δ Seller ,π PriIDH ,ηRequest to register a private digital identity.

[0149] Fig. 9 It shows how to use Zokrates to generate zero-knowledge proofs and verify smart contracts, and finally complete the zero-knowledge proof verification process:

[0150] (1) Use Zokrates’ Domain-Specific Language (DSL) to construct the arithmetic circuit constraint equation Z (Private Inputs, Public Inputs) of the problem to be proved, where Private Inputs are private inputs that cannot be made public, and Public Inputs are public inputs that can be made public;

[0151] (2) Use Zokrates to perform compilation, compile(Z), and convert Z(Private Inputs, Public Inputs) into an arithmetic circuit AC.

[0152] (3) Execute, Setup, convert the arithmetic circuit into a quadratic arithmetic program QAP, and obtain the public reference string CRS, where the public reference string CRS includes two parts: Verification key and Proving key. Verificationkey = {V α ,V β ,V γ ,V δ ,V γ _abc}, where V α =αG、V β =βH、V γ =γH、V δ =δH,

[0153] (4) The verifier obtains the Verificationkey in the public reference string CRS and uses Zokrates to generate the Ethereum blockchain verification smart contract, VerifyContract. This contract uses Ethereum's precompiled elliptic curve libraries EIP196 and EIP197 to implement elliptic curve bilinear pairing.

[0154] (5) The prover obtains the Provingkey, and uses the private input PrivateInputs and the public input PublicInputs as input parameters, and performs the Prove operation to generate a zero-knowledge proof, π = {A1, B1, C1, PublicInputs}, where A1 = AG, B1 = BH, C1 = CG, and PublicInputs is the public input.

[0155] (6) The prover submits the zero-knowledge proof π = {A1, B1, C1, Public Inputs} to the verifier. The verifier calls the smart contract VerifyContract to complete the verification of the zero-knowledge proof π = {A1, B1, C1, Public Inputs} on the chain in an open, transparent and privacy-preserving manner.

[0156] Step 2: First, the trusted regulator calls the smart contract PriIDHolderSc(π PriIDH ), proves that the seller is pk Seller ,δ S eller holders. Second, credible regulatory agencies have a pri-Seller Digital signature sig Re (pk pri-Seller ) and returns the signature value to the seller.

[0157] The buyer will also get pk based on this process pri-Buyerand sig Re (pk pri-Buyer ). The buyer generates a private key sk Buyer and public key pk Buyer =h(sk Buyer ), the public key pk Buyer As the only real identity; second, the buyer generates a random number δ Buyer and β, calculate the private identity (private public key) pk pri-Buyer =h(pk Buyer ||δ Buyer ) and η = h(β), where η will be used to prevent processability attacks (see Algorithm 5 for details); third, the buyer uses pk pri-Buyer is the common input, (sk Buyer ,δ Buyer ) is the privacy input, based on Algorithm 2 and the received ProvingKey, execute Fig. 9 The "Proof" operation in generates the zero-knowledge proof π' of the buyer's privacy identity proof contract PriIDH ={A PriDH ,B PriDH ,C PriDH ,Public Inputs=pk pri-Buyer}; Fourth, the buyer submits the pk to a trusted authority Buyer ,δ Buyer ,π PriIDH ,ηRequest to register a private digital identity.

[0158] 3. On-chain registration of data:

[0159] Step 1: First, the seller obtains the hash value α=h(h(m)) twice for the data m, and uses α as the unique identifier of the data. The seller generates the private key and public key (Psk seller , Ppk seller ), using the public key Ppk seller Encrypt m to get the ciphertext M, store M in IPFS, and obtain the hash address AddrM of M; second, the seller calculates the ownership binding relationship R of the data α =h(pk pri-Seller ||α); Third, the seller uses R α Construct a Merkle hash tree for the leaf nodes and calculate the root of the tree And auxiliary authentication information of leaf nodes Fourth, the seller For public input, For privacy input, based on Algorithm 3 and the received ProvingKey, execute Fig. 9 The "Proof" operation in generates a zero-knowledge proof Fifth, the seller sends AddrM,π Owne Send a request to a trusted regulatory agency to register key information proving data ownership on the chain, providing a basis for credible proof of ownership in subsequent data sales.

[0160] Step 2: First, the trusted regulatory agency saves AddrM and calls the smart contract PriOwnerSc(πOwne) to verify that the seller is the holder of the privacy identity (privacy public key) and data ownership; second, the trusted regulatory agency obtains the data from π Owne Extract α, and obtain the current timestamp T1, and find The digital signature sign1 is used to Go to the chain and get the address addr on the chain id .

[0161] 4. Sale of Data:

[0162] Step 1: First, the seller For public input, For privacy input, based on Algorithm 5 and the received Proving Key, execute Fig. 9 The "Proof" operation in generates a zero-knowledge proof π 1Owner ={A 1Owner ,B 1Owner ,C 1Owner ,Public To prove it is a private identity pk pri-Seller and the holder of data α, while preventing access to π Owner Malicious users can carry out processability attacks (π Owner With π 1Owner There is a clear difference between the public inputs of 1Owner and a description of the data to the sales platform, requesting the sales platform to sell the data externally.

[0163] Step 2: First, the data market starts from π 1Owner Extraction of α, and search the chain for the transaction corresponding to the latest timestamp Then the public key of the trusted regulator is used to verify the validity of sign1; second, after sign1 is verified, the trusted regulator calls the smart contract PriOwner1Sc(π 1Owner ), verify that the seller is the private identity pk pri-Seller And the holder of data α. Third, the data market releases the description of the data to the outside world.

[0164] 5. Privacy transfer of purchased data and data ownership:

[0165] Step 1: First, the buyer matches the description of the data to be purchased in the data market and obtains a secure communication channel with the seller. pri-Buyer is the common input, (sk Buyer ,δ Buyer ) is the privacy input, based on Algorithm 2 and the received ProvingKey, execute Fig. 9 The "Proof" operation in generates the zero-knowledge proof π' of the buyer's privacy identity proof contract PriIDH ={A PriDH ,B PriDH ,C PriDH ,PublicInputs=pk pri-Buyer}; Second, the buyer generates the private key and public key (Psk Buyer , Ppk Buyer ); Third, the buyer will Ppk Buyer ,π' PriIDH and sig Re (pk pri-Buyer ) is sent to the seller to request the purchase of data and obtain a private transfer of ownership.

[0166] Step 2: First, the seller calls the smart contract PriIDHolderSc(π' PriIDH ), and use the public key of the trusted regulator to verify the sig Re (pk pri-Buyer ) to verify the validity of the buyer is the holder of a private identity that has been registered with a trusted regulatory agency; second, the seller calculates the new ownership relationship R Bα =h(pk pri-Buyer ||α), and based on R Bα and auxiliary authentication information Compute new Merkle root Third, the seller will R Bα , Sent to the buyer; Fourth, the seller is a common input, with ) is the privacy input, based on Algorithm 4 and the received Proving Key, execute Fig. 9 The "Proof" operation in generates a zero-knowledge proof π Authri , to prove that the seller is the private identity pk pri-Seller and data α The owner of the pk pri-BuyerIn the case of R, the ownership of data α is transferred to the buyer, and the ownership relationship after the transfer becomes R Bα ; Fifth, the seller uses his proxy to re-encrypt the private key Psk Seller and the buyer's public key Ppk Buyer Generate the proxy re-encryption key ProxyKey; Sixth, the seller will π Authri The ProxyKey is sent to the trusted regulatory agency, requesting that the key information of privacy authorization be uploaded to the chain, providing a basis for credible proof of ownership when the data is subsequently sold again.

[0167] Step 3: First, the trusted regulator calls the smart contract PriAuthorizeSc(π Authri ), verify whether the seller is the private identity pk pri-Seller and the holder of data α, and verify whether the seller is not revealing the buyer’s privacy identity pk pri-Buyer In the case of R, the ownership of data α is transferred to the buyer, and the ownership relationship after the transfer becomes R Bα ; Second, the trusted regulator reads the ciphertext M corresponding to α from IPFS based on the previously stored AddrM, and uses the proxy key ProxyKey to convert M to M new , then M new Deposit into IPFS and obtain the address AddrM new The trusted regulator obtains the latest timestamp T2 and Digitally sign sign2, and then Deposit it into the blockchain distributed ledger and obtain the on-chain address addr2 id , where addr id yes The on-chain address of indicates that both transactions are for the transfer of ownership of the same data.

[0168] Step 4: First, after the buyer obtains privacy authorization, he uses an anonymous blockchain account to query the transaction on the chain Second, the buyer based on the queried AddrM new， Get the ciphertext M from IPFS new , using its proxy re-encrypted private key Psk Buyer Decrypt M new , obtain the plaintext m of the digital content; third, the buyer obtains two hash values ​​of the plaintext m and compares the results with α. If they are the same, it means that the correct privacy authorization has been obtained.

[0169] On the other hand, after obtaining the plaintext of the data, the purchaser can sell the data to other purchasers according to the above steps "(4) Sale of data" and "(5) Purchase of data and privacy transfer of data ownership", and append a new privacy authorization record on the chain to form a data ownership tracking evidence chain.

[0170] This embodiment constructs a zero-knowledge proof for an on-chain zero-knowledge proof contract for identity privacy protection, data ownership protection, and commercial behavior privacy protection based on the Groth16 zero-knowledge proof algorithm, and combines proxy re-encryption and the non-tamperable and traceable blockchain distributed ledger technology to construct a data privacy protection and ownership traceability solution, comprehensively solving the above security and privacy problems. Secondly, in the process of constructing the zero-knowledge proof scheme in this embodiment, the problem of malleability attacks of the Groth16 algorithm is considered, and a specific smart contract is constructed to prevent the occurrence of malleability attacks, further ensuring the security of data transactions. The method of this embodiment can achieve the following security goals: privacy protection of data, security of zero-knowledge proof, identity privacy of data owners and data purchasers, protection of data ownership, privacy protection of commercial behavior, and security and trustworthiness of the transaction process.

[0171] First of all, the data in this embodiment is encrypted through proxy re-encryption throughout the entire transfer process. Except for data sellers and purchasers, no one can obtain the plaintext of the data during the transfer process. Therefore, the method of this embodiment meets the privacy protection of data.

[0172] Secondly, the achievement of security goals other than the privacy protection of data can be reduced to the solution of the malleability attack of the Groth16 algorithm; the zero-knowledge property, completeness, and soundness of the Groth16 zero-knowledge proof algorithm; the one-wayness and collision resistance of the Sha256 hash algorithm; and the honesty and trustworthiness of a trusted regulatory agency.

[0173] This embodiment selects 3 representative research schemes from related work and makes a qualitative comparison with the scheme to be constructed in this embodiment to illustrate that the scheme of this embodiment has better performance in terms of security and privacy protection and can effectively solve the 5 challenges mentioned in the introduction part. Table 7 shows the comparison results, √: having this feature, 乄: partially having this feature, ×: not having this feature. As can be seen from Table 7, the scheme of this embodiment fully considers the 5 challenge problems and has better security and privacy characteristics.

[0174] Table 7

[0175]

[0176] In order to evaluate the relevant indicators of smart contracts and distributed ledgers, this embodiment creates an Ubuntu virtual machine in a computer with an i7-8550U processor and 16GB of memory, and deploys the Ganache Ethereum test network on it. Then, Zokrates is used to generate smart contracts corresponding to Algorithms 2 to 5 of this embodiment, and Remix is ​​used to deploy different smart contracts to the Ganache Ethereum test network to complete the indicator test through the test network.

[0177] First, since the zero-knowledge proof of this embodiment is based on the Zokrates structure, it includes the generation of off-chain zero-knowledge proof, the generation of off-chain verification smart contracts, the deployment of on-chain zero-knowledge proof smart contracts, and the verification of on-chain zero-knowledge proof smart contracts. Off-chain operations do not affect the performance of the system, so zero-knowledge proof mainly evaluates the deployment and verification of on-chain zero-knowledge smart contracts.

[0178] For the deployment of smart contracts, the main evaluation is the amount of gas consumed when different smart contracts are deployed to the Ethereum blockchain. Algorithms 2 to 5 of this embodiment will generate four smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc respectively, while Algorithms 3 to 5 all contain Merkle tree reserve proofs. in Data ownership R α Merkle-assisted authentication information, when the number of data ownership is 4, The number of hash values ​​contained in is 2, that is, as the number of ownerships in the leaf nodes increases, the size of the auxiliary authentication information will increase, and the relationship between the two is N = [log2 (n) ], where N is the number of hash values ​​contained in the auxiliary authentication information, [X] is the rounding symbol, and n is the number of leaf nodes. In other words, when evaluating the gas consumption when different smart contracts are deployed, the number of leaf nodes needs to be considered. Therefore, this embodiment tests the gas consumption of the four smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc when deployed to the Ethereum private chain with different numbers of leaf nodes. In order to make the evaluation more meaningful, this embodiment uses formula (1) to convert the gas consumption into the consumption of Ether ETH in the Ethereum public chain, where the gas price in the public chain used is the middle price of 10Gwei in October 2024. Figure 2 The test results of this embodiment are shown. It can be seen from the figure that as the number of leaf nodes in the horizontal axis n={2 3 ,2 5 ,2 7 ,2 9 ,211 ,2 13 ,2 15 ,2 17 ,2 19}, the deployment cost of each smart contract in the vertical axis remains almost unchanged, and the consumed ETH is also small. Therefore, the deployment cost of smart contracts will not be affected by the number of leaf nodes in the Merkle tree reserve proof. The above reasons are mainly due to the auxiliary authentication information in Algorithms 3 to 5. It is mainly used as the privacy input of the algorithm. From the formula of the zero-knowledge proof algorithm of Groth16 described in this embodiment, it can be seen that the privacy input will be accumulated into different numerical variables, and the smart contract ultimately implements bilinear pairing. The numerical variables used for pairing are the accumulated values ​​of the privacy input and the public input, so they will not be affected by the number of leaf nodes.

[0179] ETH=Gas used *Gas price (1)

[0180] For the execution of smart contracts, it is necessary to evaluate the execution time and the gas consumption of the execution. Figure 2 ,This embodiment also evaluates the smart contract execution time and the ,gas consumption of the execution at different leaf nodes. Figure 3 is the execution time of the smart contract. As the number of leaf nodes increases, the execution time of each smart contract remains basically unchanged, and the execution time is no more than 0.7 seconds. Figure 4 The gas consumption for smart contract execution, as the number of leaf nodes increases, the gas consumption of each smart contract remains basically unchanged, and the consumed ETH is also relatively small.

[0181] Secondly, the operation evaluation of the distributed ledger in this embodiment mainly considers the on-chain storage overhead and transaction time overhead of the ownership tracking evidence chain. As for the storage overhead, a new data transaction will store data in the distributed ledger as follows: where α and is the output of the SHA256 hash algorithm, which is 32 bytes long. T1 and T2 are timestamps with a length of 4 bytes. new The hash address of IPFS has a default length of 32 bytes. id is the Ethereum chain transaction address, which is 20 bytes long. sign1 and sign2 are digital signature algorithms based on the secp256k1 elliptic curve, which are 64 bytes long. Therefore, the chain storage overhead for completing a new data transaction is 316 bytes. In addition, for multiple transactions of the same data, each transaction is Add a new one based on Each newly added data size is 184 bytes. Based on the above, this embodiment tests the storage overhead of different data quantities and multiple transactions of the same data. The test results are as follows: Figure 5 As shown, it is obvious that with the increase of the number of data (left) and the number of transactions (right) on the horizontal axis, the on-chain storage overhead shown on the vertical axis will increase, but the increase is still small.

[0182] Regarding the on-chain time cost, the ownership tracking evidence chain includes two types of transactions: and The former has an on-chain storage overhead of 132 bytes, while the latter has an on-chain storage overhead of 184 bytes. Therefore, this embodiment tests the execution time of the two transactions under different numbers of transactions. The test results are as follows: Figure 6 As shown, it is obvious that as the number of transactions increases, the transaction time remains basically unchanged, and the average transaction time is about 0.24 seconds.

[0183] Table 7 has made a qualitative comparison. From the comparison results, it can be seen that the method proposed in this embodiment has better privacy and security characteristics, especially in terms of privacy protection of commercial behavior. This embodiment can ensure that except for the data owner and the data buyer, no one can know to whom the ownership of the data is transferred after the transaction, and the transaction is completed in an open and transparent blockchain. In addition, for quantitative comparison, since smart contracts are the core of achieving security and privacy protection, this embodiment compares the deployment and execution consumption of all smart contracts with the deployment and execution consumption of smart contracts in prior art 1 (AlsharifA, Nabil MA blockchain-based medical data marketplace with trustless fair exchange and access control [C] / / GLOBECOM 2020-2020 IEEE Global Communications Conference. IEEE, 2020: 1-6) and prior art 2 (Gupta P, Dedeoglu V, Kanhere SS, et al. TrailChain: Traceability of data ownership across blockchain-enabled multiple marketplaces [J]. Journal of Network and Computer Applications, 2022, 203: 103389.). The specific comparison results are as follows: Figure 7As shown in the figure, since different articles contain different smart contracts, this embodiment gives the total consumption of smart contracts. Figure 6-7 It can be seen that in addition to having better security and privacy features, the solution of this embodiment has less deployment and execution consumption compared to the solutions of prior art 1 and prior art 2.

[0184] on the other hand, Figure 8 The comparison of the smart contract execution time of this embodiment scheme and the prior art 1 and the prior art 2 is shown. It can be seen from the figure that although the execution time of this method is longer than that of the prior art 1, this method has better security and privacy protection characteristics.

[0185] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A data transaction security and privacy protection method based on zero-knowledge proof smart contract, characterized in that: include: Initialize blockchain parameters; The seller and the buyer request to register a private identity with the trusted regulatory agency, and the trusted regulatory agency verifies the private identity and signs the verified private identity and returns it to the seller and the buyer; The seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, encrypts and stores the data to be sold, and obtains a ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to the trusted regulatory agency for verification. After the verification is passed, the first target information is uploaded to the chain and the address on the chain is obtained; The seller generates a zero-knowledge proof of the contract to prevent processability attacks, and requests the data market to publish the information of the data to be sold. The data market verifies the zero-knowledge proof of the contract to prevent processability attacks based on the first target information on the chain. After the verification is passed, the data market publishes the information of the data to be sold; The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification, the purchase data is encrypted and stored, the ciphertext storage address of the purchase data is obtained, and the second target information is uploaded to the chain, where the first target information is {α, T1, sign1}, the second target information is {α, T2,AddrM new ,addr id ,sign2}, α is the unique identifier of the original data, i.e. the data to be sold m, Data ownership R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain, sign1 is {α, T1} signature, addrid is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer, sign2 is {α, T2,AddrM new ,addrid} signature.

2. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 1 is characterized in that: The seller requests the trusted regulatory agency to register a private identity, and the trusted regulatory agency verifies the private identity including: The seller generates a seller private key and a seller public key; The seller generates a seller random number and a random number to prevent processability attacks, and calculates a hash value of the seller's privacy identity and the random number to prevent processability attacks; The seller's private identity is used as a public input, the seller's private key and the seller's random number are used as private inputs, and a zero-knowledge proof of the seller's private identity proof contract is generated based on the proof key; The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's private identity certification contract, and the hash value of the random number to prevent processability attacks to the trusted regulatory agency to request registration of the private identity; The trusted regulatory agency proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity certification contract.

3. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 2 is characterized in that: The seller generates a zero-knowledge proof of the ownership relationship of the data to be sold and the data ownership proof contract, including: The seller obtains hash values ​​of the data to be sold multiple times to uniquely identify the data to be sold; The unique identifier of the data to be sold and the private identity of the seller are hashed to obtain the ownership relationship; Constructing a Merkle hash tree with the ownership relationship as a leaf node, and calculating the root of the Merkle hash tree and auxiliary authentication information of the leaf node; The seller's private identity, the root of the Merkle hash tree and the unique identifier of the data to be sold are used as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree and the hash value of the data to be sold are used as private inputs, and a zero-knowledge proof of the data ownership proof contract is generated based on the proof key.

4. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 2 is characterized in that: Encrypting and storing the data to be sold, and obtaining the ciphertext hash address includes: Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key; The sales data is encrypted using the seller's re-encryption public key to obtain the ciphertext and store it in a distributed storage system to obtain the ciphertext hash address.

5. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 3 is characterized in that: The zero-knowledge proof generated by the seller to prevent the processability attack contract includes: The seller will use the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold and the hash value of the random number to prevent machinability attacks as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent machinability attacks and the hash value of the data to be sold as private inputs, and generate a zero-knowledge proof of the contract to prevent machinability attacks based on the proof key.

6. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 3 is characterized in that: The data market verifies the zero-knowledge proof of the contract for preventing processability attacks according to the first target information on the chain, including: The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the contract for preventing processability attacks, searches for the first target information corresponding to the latest timestamp on the chain, and verifies the validity of sign1 using the public key of the trusted regulatory agency; After the verification is passed, the trusted regulatory agency calls the zero-knowledge proof of the contract to prevent processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

7. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 4 is characterized in that: The buyer requests the seller to purchase data including: The buyer's private identity is used as a public input, the buyer's private key and the buyer's random number are used as private inputs, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key; The purchaser's private key and public key are re-encrypted by proxy, and the purchaser sends the proxy re-encrypted purchaser's public key, the zero-knowledge proof of the purchaser's privacy identity certification contract, and the signature of the purchaser's privacy identity to the seller, requesting to purchase the data; The seller calls the zero-knowledge proof of the privacy identity certification contract and uses the public key of the trusted regulatory agency to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of a privacy identity registered with the trusted regulatory agency.

8. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 3 is characterized in that: The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, including: The seller calculates the new ownership relationship based on the private identity of the buyer and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node; The seller sends the new ownership relationship, the new Merkle tree root and the auxiliary authentication information of the leaf node to the buyer; The buyer takes the root of the Merkle hash tree, the new Merkle tree root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as privacy input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

9. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 7 is characterized in that: The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract, and after the verification, encrypts and stores the purchased data including: The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key; The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency, and the trusted regulatory agency calls the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold, and at the same time verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity, and generates a new ownership relationship; After the verification is passed, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address; The ciphertext is converted into a new ciphertext using the proxy re-encryption key, stored in a distributed storage system, and a new ciphertext hash address is obtained.

10. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 3 is characterized in that: After uploading the second target information to the chain, it forms an evidence chain for ownership tracing {α, T1,sign1}←{α, T2,AddrM new , addrid, sign2}, used for ownership tracing and auditing.

Images