Linkable ring signature method for user authorization of financial science and technology block chain scene

Abstract

The invention discloses a user-authorized linkable ring signature method for a financial science and technology block chain scene, which is applied to a financial scene of a block chain, mainly aims at cross-mechanism transaction verification and privacy protection, and is characterized in that anonymous verification and traceability of transaction records are realized in combination with an authority control mechanism. The method specifically comprises the steps of system initialization, key generation, link secret generation, signature, verification, linking, authorization and link verification. Compared with the prior art, the method has the advantages that user privacy protection is supported, controllability and traceability are achieved, and efficient verification is achieved, and it is ensured that transaction data can be reliably verified while user privacy is guaranteed in the loan approval or anti-money laundering (AML) auditing process of a bank. According to the method, the problem that privacy protection and traceability are difficult to consider in a traditional signature scheme is avoided, and the security and practicability of cross-mechanism data sharing are improved.

Description

Technical Field

[0001] The present invention relates to the field of digital signature and privacy protection technology, and in particular to a linkable ring signature method for user authorization in financial technology blockchain scenarios. Background Art

[0002] The concept of ring signatures was first proposed by Rivest, Shamir, and Tauman in 2001, primarily for protecting user privacy. Ring signatures allow a user to sign anonymously within a group of users, making it impossible to determine which user in the group signed, thus protecting user privacy. However, traditional ring signature schemes suffer from a problem: they cannot prevent double signing, where a malicious user could sign the same message multiple times. This can cause problems in certain scenarios, such as in blockchains, where a user could exploit this feature to perform double spending. Researchers have therefore proposed linkable ring signatures, in which if a user signs two different messages, the two signatures can be linked together, preventing double signing and improving system security. This linkability can be group-dependent or group-independent. Group-dependent means that if two ring signatures use different obfuscation groups, it is impossible to determine whether they were generated from the same private key. Group-independent means that regardless of whether the two ring signatures use the same obfuscation group, they can be linked as long as they are generated from the same private key. In the subsequent research over the past decade or so, most of the linkable ring signature methods were based on traditional number theory problems such as discrete logarithms.

[0003] User-authorized linkable ring signatures are extremely useful in applications related to resource management that prioritizes user privacy. For example, a patient can leverage signature linkability to categorize their treatment resources by topic, allowing related documents under the same topic (i.e., treatment) to be linked. Furthermore, by authorizing signature linkability, they can share access to and download permissions for these resources with other patients. This allows sharing resources with a specific group without revealing personal information such as their identity, ensuring that the sharer also belongs to that group. However, previous methods have limited user control over the ability to determine whether signatures are linkable. Either ring signatures cannot be linked, making it impossible to trace the source in the event of malicious multiple signatures, or any group on the ring can determine whether two ring signatures are linkable, thereby leaking additional information about the signers and allowing malicious users to exploit it. Furthermore, users cannot flexibly share signature-related information. Therefore, the present invention builds on the original user-controllable ring signature method and combines it with attribute-based encryption to achieve control over the authority to determine signature linkability. This allows signatures to be tracked only when the user is authorized to track them, thereby better protecting the signer's information and enabling more flexible sharing of signature-related information.

[0004] Previous research has explored various settings and assumptions for constructing effective ring signatures, enabling logarithmic-sized ring signatures. Later, Meng-Jun Qin, Yun-Lei Zhao, and others proposed constant ring signatures, meaning that the signature size is independent of the ring size. Park and Sealfon proposed the related concepts of (non-)claimability and (non-)repudiability in ring signatures. Claimability means that after signing, the signature can always be claimed, while repudiability is the opposite: an unsigned signature can always be denied. Claimability is a concept related to user-controlled linkability. Signers can claim a signature by linking it to a dynamic pseudo-message. Signatures generated by malicious signers could potentially harm the reputation of ring members (e.g., in elections). Therefore, the owner of the verification key desires the ability to claim and disclaim messages, a concept known as repudiability. Regarding anonymously published results, when the need for anonymity no longer exists, especially when imposters make competing claims, claimability provides a credible way to assert authorship.

[0005] Previous work by Dario Fiore et al. introduced ring signatures with user-controlled linkability (RS-UCL) and a variant, user-controlled and autonomous linkability (RS-UCAL), which gives users full control over the linkability of their signatures. Linkability: Any two valid signatures generated under the same event identifier are linked if they were generated by the same signer. Implicit linkability: Each signature is accompanied by a pseudonym, generated by the user within a specific scope. Reusing the same scope yields the same pseudonym, allowing all signatures with the same scope to be linked. Signatures with different scopes cannot be linked unless explicitly proven. Explicit linkability: A user can prove that they have generated a series of signatures in the past, thereby linking them. Previous work has explored linking users' anonymous signatures by using a pseudorandom function (PRF). Users can additionally sign a random value and its PRF output, where the seed is stored by the signer. Signatures can then be linked using a zero-knowledge proof of the seed.

[0006] Attribute-based encryption (ABE) was first proposed by Waters. It is a cryptographic solution for addressing the need for fine-grained access control in data sharing in cloud computing data outsourcing scenarios. Its key idea is to associate ciphertext and keys with a set of attributes and an access structure. Decryption is successful only if the attribute set satisfies the access structure. In other words, only users who meet the attribute requirements can decrypt the ciphertext, thus ensuring data confidentiality. In ABE, user keys are related to random polynomials or random numbers, making it impossible to combine the keys of different users, thus preventing collusion attacks. However, because basic ABE cannot support flexible access control policies, Goyal et al. proposed the Key-Policy Attribute-Based Encryption (KP-ABE) mechanism, building on ABE. This mechanism embeds access policies into keys and file attributes into ciphertext. Upon receiving a message, the recipient is assigned a specific access policy. This mechanism is suitable for video on demand and database access. Later, Bethencourt et al. proposed the Ciphertext-PolicyAttribute-BasedEncryption (CP-ABE) mechanism, which embeds access policies into ciphertext and user attributes into keys, so that information owners can specify ciphertext access policies, which is suitable for message distribution scenarios. Summary of the Invention

[0007] The purpose of the present invention is to provide a user-authorized linkable ring signature method for FinTech blockchain scenarios to overcome the shortcomings of the existing technology.

[0008] To achieve the above object, the present invention provides the following technical solutions: This application discloses a linkable ring signature method for user authorization in a fintech blockchain scenario, specifically comprising the following steps: S1, system initialization phase: system initialization, generation of public parameters and functions; S2, key generation phase: input security parameters and attribute sets, output signature key, public key and authorization key; S3, link secret generation phase: input security parameters and output link secret; S4, signing phase: input the signing key obtained in step S2, the link secret obtained in step S3, the ring, the message and the scope, and output the pseudonym and signature; S5, verification phase: input message, scope, ring, signature and pseudonym; if the signature is a valid signature on the ring, it returns 1, otherwise it returns 0; S6, Linking phase: Input a set of signature tuples, link secret, and link message; if the signatures in the set of signature tuples are generated by the same signer based on the link message, then the signatures are linked, and output proof Otherwise, an error symbol is output. ; S7, authorization phase: input the public key, certification and access phase, the algorithm encrypts and generates ciphertext, the ciphertext can only be decrypted by users who have the attribute set that satisfies the access structure; S8, Verification link phase: If the attribute set satisfies the access structure, it means that the user is an authorized user, and the proof is obtained by decrypting the ciphertext through the algorithm. ,if If it is a valid proof, it means that the signatures in the signature tuple are linked, that is, the signature tuple is generated by the same signer based on the linked message, and returns 1; otherwise, it returns 0.

[0009] Preferably, step S1 specifically includes the following operations: S11, order As a cryptographic hash function; S12. For , for each user Each has a different public key and a private key , ,set up yes A collection of public keys; S13. Selection As an identity function ; S14, is defined as ,in ; S15, Operation generate and the corresponding ; S16, select the prime order , the generator is Bilinear group of , then select two random indices ; S17, Order , .

[0010] Preferably, step S2 specifically includes the following operations: S21. Generate ring signature encryption public key and private key: Enter security parameters , ; S22. Generate authorization key: The master key is , calculated using the master key , choose a random number ,for Each attribute Select random number ; Calculate the key ; ; Return the signature private key and public key , and the authorization key ,Right now .

[0011] Preferably, step S4 specifically includes the following operations: in a financial scenario of the blockchain, the user signs the transaction message; S41. Generate pseudonyms : ; ; ; ; S42. Generate the signature of the ring signature: ; ; and ; ; ; ,in ; ； calculate ; ; S43. Generate AKRS signature : ; ; ; ; S44. Get signature: ; ； return .

[0012] Preferably, step S5 specifically includes the following operations: in the financial scenario of the blockchain, the bank verifies the validity of the signature generated by the user; S51. Ring signature verification: ; For ring signatures ; calculate ; in ; like If the ring signature is a valid signature, the next step of verification will be carried out; otherwise, it is an invalid signature and 0 is returned; S52, AKRS verification: If , returns 0; ;like , returns 1, otherwise returns 0.

[0013] Preferably, step S6 specifically includes the following operations: linking signatures generated by the same user: Generate link proof ; like ,return ; like ,return ; like ,return ; ; ;return .

[0014] Preferably, step S7 specifically includes the following operations: the user authorizes the bank; S71. Cryptographic Proof: Encryption Algorithm in Tree Access Structure Next message To encrypt. First Each of Select Polynomial ; From the root node To begin, these polynomials are selected in the following top-down manner; for each node in the tree , the polynomial The order Set to the threshold of the node Small 1, that is ; S72, starting from the root node R, the algorithm selects a random , and set ; Randomly select polynomials The other points in the complete definition; for any other node ,set up , and randomly select Other points are fully defined ; S73, set yes The set of leaf nodes in . Then by giving the access structure of the tree And calculate the following formula to construct the ciphertext: ; ; return .

[0015] As a preference, step S8 specifically includes the following operations: the authorized bank can perform linkability verification on the signature, S81, Decryption get : Define a recursive algorithm ; Algorithm input is ciphertext ; ; Private Key and Node in is a leaf node, let , defined as follows: If but: ; ; ; like ,definition ; for All child nodes of , call and store the output as ;set up Is any size Child nodes of The collection of . ; If there is no such set, the node is not satisfied and the function returns ; Otherwise, calculate: ,in And return the result; The decryption algorithm first calls the root node of the tree The function above; the Decrypt algorithm takes the public key PK, ciphertext CT, and private key ak as input; if the attribute set satisfies the access structure, the algorithm decrypts the ciphertext and returns ; S82. Verification link: ; like ,return ; like ,return ; like ,return ; ; like , returns 0; ; like , returns 1, otherwise returns 0.

[0016] Beneficial effects of the present invention: 1. This invention builds on the existing user-controllable ring signature method and combines it with an attribute-based encryption method to control the authority to determine signature linkability. This allows signatures to be tracked only when the user is authorized to track them, thereby better protecting the signer's information and enabling more flexible sharing of signature-related information.

[0017] 2. The present invention constructs a security model for the proposed user-authorized linkable ring signature method, which includes its anonymity, unforgeability, and non-frameability.

[0018] 3. This paper analyzes the security proof and performance overhead of the proposed user-authorized linkable ring signature method, and combines it with literature to prove that this method has excellent performance.

[0019] The features and advantages of the present invention will be described in detail through embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Schematic diagram of the system structure of the present invention; Figure 2 Flowchart of the present invention. DETAILED DESCRIPTION

[0021] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and examples. However, it should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the scope of the present invention. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the present invention.

[0022] The mathematical theory used in the present invention is described as follows: 1. Hash algorithm A hash value is a mapping of a binary value of arbitrary length to a shorter, fixed-length binary value. A hash value is a unique and extremely compact numerical representation of a piece of data. If a plaintext segment is hashed and even a single letter of the segment is changed, subsequent hashes will produce a different value. Finding two different inputs that hash to the same value is computationally impossible, so data hashes can be used to verify data integrity. They are commonly used for fast lookup and encryption algorithms.

[0023] 2. Zero-knowledge proof Zero-knowledge proof was first proposed by S. Goldwasser, S. Micali and C. Rackoff in their paper “The Knowledge Complexity of Interactive Proof Systems” in 1985. It is a cryptographic protocol used by the prover to prove the correctness of the knowledge he has mastered without revealing any other information. One party in the protocol is called the prover. Indicates; the other party is called Verifier, Indicates. Zero-knowledge proof refers to Trying to make Believe that a statement is correct, but do not Leaking any useful information, i.e. In the process of argumentation No useful information is obtained. Zero-knowledge proof does not reveal any other information or knowledge except proving the correctness of the prover's assertion.

[0024] Zero-knowledge proof generally includes the following stages: Commit: The prover makes a commitment to the proposition, which waits for the verifier to challenge and verify.

[0025] Challenge: The validator chooses a random number (i.e., a row, column, or grid in the above example) to challenge the proposed commitment.

[0026] Response to the challenge: The prover combines the received random number with the given commitment (the commitment cannot be modified) and returns a response to the challenge.

[0027] Verify: The verifier verifies whether the response to the challenge is correct. If it is incorrect, the proof fails.

[0028] The prover and the verifier repeat the above steps until the probability of belief reaches the conditions accepted by the verifier, and the proof is successful.

[0029] Zero-knowledge proof has the following characteristics: Completeness: If the prover and the verifier are honest and follow the correct calculations at every step of the proof process, the proof will succeed and the verifier will be able to accept the prover. Soundness: No one can impersonate the prover and make the proof successful; Zero-Knowledge: After the proof process is completed, the verifier only knows that "the prover has this knowledge" without obtaining any information about the knowledge itself.

[0030] Schnorr uses the zero-knowledge proof of discrete logarithms to design an identity authentication protocol. , yes , and then choose a generator , select a random number , calculate , then the private key is , the public key is Alice, the prover, can use the zero-knowledge proof method to prove to Bob, the verifier, that she knows a , making .

[0031] Protocol Description: Step 1: Alice chooses a random number , send To Bob.

[0032] Step 2: Bob chooses a random number , Sent to Alice.

[0033] Step 3: Alice calculates .

[0034] Step 4: Bob Verifies .

[0035] Protocol Description: ; 3. CPA games and CPA security are defined as follows: Assumptions is the plaintext space, is the ciphertext space, represents the public key, Represents a private key. Is a security parameter. By default, the adversary has the public key Here is the process of challenging the game: (1) The simulator determines the encryption scheme and generates a public-private key pair , announced and encryption schemes.

[0036] (2) The adversary can query the encryption machine in probabilistic polynomial time.

[0037] (3) The adversary from the plaintext space Choose any two plaintexts , sent to the challenger.

[0038] (4) The simulator selects a ,encryption form And return it to the adversary.

[0039] (5) The opponent can Perform any calculation or operation a limited number of times, and you can also query the encryption machine within the polynomial number of times, and guess the plaintext encrypted by the challenger in the previous step is still , and output the guess result, the output result is recorded as .

[0040] (6) If , then the adversary's attack is successful.

[0041] In this game, if the adversary passively guesses the outcome randomly, then the probability of his winning is , and an active adversary can influence the probability of success through various calculations or operations. , the CPA security of the scheme can be defined as: , if for all probabilistic polynomial-time adversaries , there is a negligible function , there is always , which means that the data privacy of this scheme can effectively resist chosen plaintext attacks.

[0042] 4. Schnorr Signature Algorithm: The Schnorr signature algorithm was originally proposed by German cryptographer Claus Schnorr in 2008. In cryptography, it is a digital signature scheme known for its simplicity and efficiency. Its security is based on the intractability of certain discrete logarithm problems.

[0043] Algorithm composition: Public and private key generation algorithm : Select an elliptic curve Basis Point ;Select private key For the The order of , using the base point Calculate the public key ; Signature generation algorithm : Pick a random integer ; Calculation point ;calculate ; Get signature ; Signature verification algorithm : Verify the equation: ; If the equation holds, output 1, otherwise output 0.

[0044] In addition to the above form, Schnorr signature has another form: Signature generation algorithm : Pick a random integer ; Calculation point ;calculate ;calculate ; Get signature ; Signature verification algorithm :calculate ; Verify the equation ; If the equation is true, output 1, otherwise output 0; 5. Bilinear pairing: Define a bilinear pairing as ,in , and is a prime order The multiplication group of . Let is a map with the following properties: Bilinear: .

[0045] Non-degeneracy: exists , making ,in Represents an identity element in a group.

[0046] Computability: For all There is an efficient algorithm to calculate .

[0047] There are three main types of pairings: Type 1: Group same.

[0048] Type 2: , but there is an isomorphism , can be obtained from Efficient calculation .

[0049] Type 3: , nor does there exist an effective computable isomorphism exist between.

[0050] This method construction will use the first type of bilinear pairing.

[0051] 6. User-controlled linkable ring signature scheme (RS-UCL) The user-controlled linkability ring signature scheme is The PPT algorithm composed of tuples satisfies the requirements of correctness, anonymity, unforgeability and non-frameability. The details are as follows: : Input a security parameter and output a signing key and a verification key . : By secret signing key The verification key set, that is, the ring Message Sign, scope is Output pseudonym and a ring signature . : Input a signature tuple ,if and Message and with Related scopes If valid, it returns 1, otherwise it returns 0. : Input a set of signature tuples , user key and link messages , if these signatures are linked, output the proof Otherwise, an error symbol is output. . :if is a valid proof, and is signed by the same signer based on the linked message Returns 1 if generated, 0 otherwise.

[0052] Ring signatures with user-controlled and autonomous linkability (RS-UCAL) allow users to choose a linking secret independently of the signing key, and thus freely choose which signatures are linkable.

[0053] 7. User-controlled and autonomous linkable ring signature (RS-UCAL): User-controlled and autonomous linkable ring signature is The PPT algorithm composed of tuples satisfies the requirements of correctness, anonymity, unforgeability and non-frameability; The details are as follows: : Input a security parameter and output a signing key and a verification key . : Input a security parameter and output a link secret .

[0054] : By secret signing key The verification key set, that is, the ring Message Sign, scope is , additional input Output pseudonym and a ring signature . : Input a signature tuple ,if and Message and with Related scopes If valid, it returns 1, otherwise it returns 0. : Input a set of signature tuples , link secret and link messages , if these signatures are linked, output the proof Otherwise, an error symbol is output. . :if is a valid proof, and is signed by the same signer based on the linked message Returns 1 if generated, 0 otherwise.

[0055] 8. Knowledge about attribute-based encryption schemes: Attribute-based encryption encrypts messages based on attributes, regardless of the recipient's identity. The idea is to associate the ciphertext and key with a set of attributes and an access structure. Decryption is successful only if the attribute set satisfies the access structure. In other words, only users who meet the attribute requirements can decrypt the ciphertext, thus ensuring data confidentiality. Furthermore, user keys in ABE are related to random polynomials or random numbers, preventing the combination of keys from different users, thus preventing collusion attacks. However, basic ABE cannot support flexible access control policies. Building on ABE, Goyal et al. proposed the Key-PolicyAttribute-Based Encryption (KP-ABE) mechanism, which embeds access policies into keys and file attributes into ciphertext. Upon receiving a message, the recipient is assigned a specific access policy. This mechanism is suitable for video on demand and database access. Subsequently, Bethencourt et al. proposed the Ciphertext-PolicyAttribute-Based Encryption (CP-ABE) mechanism, which embeds access policies into ciphertext and user attributes into keys, allowing the information owner to specify access policies for ciphertexts. It is well-suited for building secure data sharing solutions in cloud environments, particularly for message distribution scenarios. In CP-ABE, the data owner—the person who encrypts the plaintext and obtains the ciphertext—can define an appropriate access structure based on their needs, enabling decryption for designated users.

[0056] In CP-ABE, the roles of each participant are determined by attributes, so an access structure is defined to express the authorized attribute set. The set in the access structure is the authorized set, and the set not in the access structure is the unauthorized set.

[0057] Usually, a tree structure can be used to express the access structure. The internal nodes of the tree represent AND, OR, and threshold operations, and the leaf nodes represent attributes. The above tree structure can be called an access tree. If you use Represents a node The number of child nodes, express The threshold value of .when , is the OR gate, when , is the AND gate. Each leaf node represents an attribute, and the threshold ; After you have the access tree, you can use the following method to determine whether the user attributes meet the access tree. Represents a visit tree, Indicates is the subtree of the root node. satisfy , mark it as By iterative method Perform calculations. If Is a non-leaf node, calculate All child nodes of hour, .if Is a leaf node, when belong hour, .

[0058] CP-ABE includes four basic algorithms ; : Only accepts implicit security parameters as input. Outputs public parameters and master key .

[0059] :enter ,information and access structures ,right Encrypt and generate ciphertext .

[0060] : Enter the master key and a collection of properties describing the key , output the private key .in, Determined by attributes.

[0061] : Enter common parameters , including access structures Ciphertext , and the private key . Note that the private key here is represented by the attribute collection Generate. If Able to meet , then Decrypt and return the message .

[0062] 9. Accumulator: In cryptography, an accumulator is a one-way membership hash function. It allows users to prove that a potential element is a member of a set without revealing individual members of the set. This concept was formally proposed by J. Benaloh and M. de Mare in 1993. An accumulator is a tuple ,in , The value range of the accumulator , is a set of pairing functions, each are defined as For some ,as well as is a two-camera function, where and Represents functions respectively and The value range of In order to facilitate the representation of subsequent method design, the following definitions are made: : With a safety parameter As input, and output a random element .

[0063] Quasi-commutativity: For any : For any and ,say For collection right The cumulative value of . Due to quasi-commutativity, the value and The order of is irrelevant, use express.

[0064] : Indicates the process of calculating cumulative values.

[0065] : For each and The polynomial constraint size of : exist is computable in polynomial time, there is a witness This means that some variables Already in , if In the accumulation, the algorithm represents the computation witness process.

[0066] In this method, using the same accumulator, the function is defined as ,Right now and , is the identity function .

[0067] The present invention is further described and explained in detail below with specific implementation: Example 1: See Figure 1 The blockchain-based ring signature user identity privacy protection and bank compliance supervision system consists of users, banks, key generation centers, and blockchain entities. The key generation center generates keys for users and banks. Users generate ring signature public-private key pairs and linking secrets. During transactions, the private key and the ring signature algorithm are used to generate a signature containing an encrypted hash of the transaction data. This signature is uploaded to the blockchain for storage and can be authorized to the bank. The bank obtains the signature and transaction data from the blockchain, verifies its validity and integrity using a set of public keys, and, after authorization, uses the linking secret to associate the signature with the user to determine the user's identity and conduct compliance analysis such as anti-money laundering. As a storage platform, the blockchain securely stores user signatures and transaction data, building a reliable bridge for data exchange between users and banks.

[0068] See Figure 2 The implementation process of the present invention specifically includes the following steps: (1) System initialization phase: The system generates the required parameters and functions under given security parameters.

[0069] (2) Key generation stage: Enter security parameters and attribute sets , output signature key and public key and the authorization key .

[0070] (3) Generate link secret stage: Enter security parameters , output a link secret .

[0071] (IV) Signature stage: Enter the signing key , link secret ,ring , a message and scope , output pseudonym and signature .

[0072] (V) Verification stage: Enter a message , scope ,ring ,sign and Kana ,if It is an in-loop If the signature is valid, it returns 1; otherwise, it returns 0.

[0073] (6) Linking stage: Input a set of signature tuples Link Secret and link messages , if these signatures are linked, output the proof Otherwise, an error symbol is output. .

[0074] (7) Authorization stage: Enter the public key ,prove and access phase , the algorithm encrypts and produces ciphertext , only users with the set of attributes that satisfy the access structure can decrypt the message. Assume that the ciphertext implicitly contains .

[0075] (8) Verification link stage: If the attribute set satisfies the access structure, the algorithm decrypts get ,if is a valid proof, and is signed by the same signer based on the linked message Returns 1 if generated, 0 otherwise.

[0076] The symbols and meanings of all the above steps are shown in Table 1 below: Table 1 List of symbols The specific operations of the system initialization phase in step (1) are as follows: (1) Order As a cryptographic hash function; (2) For , for each user Each has a different public key and a private key ,so ,set up yes A collection of public keys; (3) Selection As an identity function ; (4) is defined as ,in ; (5) Operation generate and the corresponding ; (6) Select the prime order as , the generator is Bilinear group of , then select two random indices ; (7) Order , .

[0077] The specific operations of the key generation phase in step (2) are as follows: (1) Generate ring signature encryption public key and private key: Enter security parameters , (2) Generate authorization key: available during initialization The master key is , we can use the master key to calculate , choose a random number ,for Each attribute Select random number .

[0078] Then calculate the key Returns the signature private key and public key , and the authorization key ,Right now .

[0079] The specific operations of the step (3) of generating the link secret are as follows: (1) Generate link secret: ,return .

[0080] The specific operations of the signing phase in step (4) are as follows: (1) Generate pseudonyms : (2) Generate the signature of the ring signature: and ,in calculate (3) Generate AKRS signature : (4) Obtain signature: return .

[0081] The specific operations of the signature verification phase in step (5) are as follows: (1) Ring signature verification: For ring signatures calculate in .

[0082] if The ring signature is a valid signature and the next step of verification is carried out. Otherwise, it returns 0 if the signature is invalid. (2) AKRS Verification: if , returns 0 if , returns 1, otherwise returns 0.

[0083] The specific operations of the linking phase in step (six) are as follows: (1) Generate link proof if ,return ; if ,return ; if ,return ; return .

[0084] The specific operations of the authorization stage in step (seven) are as follows: (1) Cryptographic Proof: Encryption algorithm in tree access structure Next message To encrypt. First Each of Select Polynomial From the root node To begin, these polynomials are selected in the following top-down manner. For each node in the tree , the polynomial The order Set to the threshold of the node Small 1, that is .

[0085] Starting from the root node R, the algorithm selects a random , and set . Then randomly choose the polynomial To fully define it, we need to use the other points in ,set up , and randomly select Other points are fully defined .

[0086] set up yes The set of leaf nodes in . Then by giving the access structure of the tree And calculate the following formula to construct the ciphertext: return .

[0087] The specific operations of the link verification phase in step (eight) are as follows: (1) Decryption get : First define the recursive algorithm The algorithm input is ciphertext Private Key and Nodes in .

[0088] If the node is a leaf node, let , and defined as follows: If , then we have: if ,definition .

[0089] Now consider The recursive case when is a non-leaf node. The algorithm performs the following operations: All child nodes of , call and store the output as .set up Is any size Child nodes of The collection of If no such set exists, then the node is not satisfied and the function returns Otherwise, calculate: ,in and returns the result.

[0090] The decryption algorithm simply calls the root node of the tree The Decrypt algorithm takes the public key PK, the ciphertext CT (including the access policy A), and the private key ak as input. If the attribute set satisfies the access structure, the algorithm decrypts the ciphertext and returns .

[0091] (2) Verification link if ,return ; if ,return ; if ,return ; if , returns 0.

[0092] if , returns 1, otherwise returns 0.

[0093] This invention proposes a user-authorized linkable ring signature method for fintech blockchain scenarios. Building on the existing user-controllable ring signature method, it incorporates attribute-based encryption to control the authority to determine signature linkability. This ensures that signatures can be tracked only when the user is authorized to do so. This better protects the signer's information and enables more flexible sharing of signature-related information. This method, applied to blockchain financial scenarios, primarily targets cross-institutional transaction verification and privacy protection. It incorporates a permission control mechanism to achieve anonymous verification and traceability of transaction records. This method supports user privacy protection, controllable traceability, and efficient verification, ensuring that banks can reliably verify transaction data while safeguarding user privacy during loan approvals or anti-money laundering (AML) audits. This method avoids the difficulty of balancing privacy protection and traceability in traditional signature methods, improving the security and practicality of cross-institutional data sharing.

[0094] Based on the original user-controllable ring signature method, combined with attribute-based encryption, it realizes the control of the authority to determine the linkability of the signature, and ensures that the signature can be tracked only when the user is authorized to track it, thereby better protecting the signer's information and achieving more flexible sharing of signature-related information.

[0095] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the claims.

Claims

1. A user-authorized linkable ring signature method for fintech blockchain scenarios, characterized by: The specific steps include: S1, system initialization phase: system initialization, generation of public parameters and functions; S2, key generation phase: input security parameters and attribute sets, output signature key, public key and authorization key; S3, link secret generation phase: input security parameters and output link secret; S4, signing phase: input the signing key obtained in step S2, the link secret obtained in step S3, the ring, the message and the scope, and output the pseudonym and signature; S5, verification phase: input message, scope, ring, signature and pseudonym; If the signature is a valid signature on the ring, it returns 1, otherwise it returns 0; S6, Linking phase: Input a set of signature tuples, link secret, and link message; if the signatures in the set of signature tuples are generated by the same signer based on the link message, then the signatures are linked, and output proof Otherwise, an error symbol is output. ; S7, authorization phase: input the public key, certification and access phase, the algorithm encrypts and generates ciphertext, the ciphertext can only be decrypted by users who have the attribute set that satisfies the access structure; S8, Verification link phase: If the attribute set satisfies the access structure, it means that the user is an authorized user, and the proof is obtained by decrypting the ciphertext through the algorithm. ,if If it is a valid proof, it means that the signatures in the signature tuple are linked, that is, the signature tuple is generated by the same signer based on the linked message, and returns 1; otherwise, it returns 0.

2. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 1, characterized in that: Step S1 specifically includes the following operations: S11. Order as a cryptographic hash function; S12. For , for each user Each has a different public key and a private key , ,set up yes A collection of public keys; S13. Selection As an identity function ; S14, is defined as ,in ; S15, Operation generate and the corresponding ; S16, select the prime order , the generator is Bilinear group of , then select two random indices ; S17, Order , .

3. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 2, characterized in that: Step S2 specifically includes the following operations: S21. Generate ring signature encryption public key and private key: Enter security parameters , ; S22. Generate authorization key: The master key is , calculated using the master key , choose a random number ,for Each attribute Select random number ; Calculate the key ; ; Return the signature private key and public key , and the authorization key ,Right now .

4. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 3, characterized in that: Step S4 specifically includes the following operations: In the financial scenario of blockchain, the user signs the transaction message, S41. Generate pseudonyms : ; ; ; ; S42. Generate the signature of the ring signature: ; ; and ; ； ； ,in ; ； calculate ; ； S43. Generate AKRS signature : ； ； ； ； S44. Get signature: ; ； return .

5. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 4, characterized in that: Step S5 specifically includes the following operations: in the blockchain financial scenario, the bank verifies the validity of the signature generated by the user; S51. Ring signature verification: ; For ring signatures ; calculate ; in ; like If the ring signature is a valid signature, the next step of verification will be carried out; otherwise, it is an invalid signature and 0 is returned; S52, AKRS verification: If , returns 0; ;like , returns 1, otherwise returns 0.

6. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 5, characterized in that: Step S6 specifically includes the following operations: linking signatures generated by the same user: Generate link proof ; like ,return ; like ,return ; like ,return ; ； ； return .

7. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 6, characterized in that: Step S7 specifically includes the following operations: the user authorizes the bank; S71. Cryptographic Proof: Encryption Algorithm in Tree Access Structure Next message To encrypt. First Each of Select Polynomial ; From the root node To begin, these polynomials are selected in the following top-down manner; for each node in the tree , the polynomial The order Set to the threshold of the node Small 1, that is ; S72, starting from the root node R, the algorithm selects a random , and set ; Randomly select polynomials The other points in the complete definition; for any other node ,set up , and randomly select Other points are fully defined ; S73, set yes The set of leaf nodes in . Then by giving the access structure of the tree And calculate the following formula to construct the ciphertext: ； ； return .

8. A user-authorized linkable ring signature method for a fintech blockchain scenario as claimed in claim 7, characterized in that: Step S8 specifically includes the following operations: the authorized bank can verify the linkability of the signature, S81, Decryption get : Define a recursive algorithm ; Algorithm input is ciphertext ; ; Private Key and Node in is a leaf node, let , defined as follows: If but: ； ； ； like ,definition ; for All child nodes of , call and store the output as ;set up Is any size Child nodes of The collection of . ; If there is no such set, the node is not satisfied and the function returns ; Otherwise, calculate: ,in And return the result; The decryption algorithm first calls the root node of the tree The above function; the Decrypt algorithm takes the public key PK, ciphertext CT, and private key ak as input; If the attribute set satisfies the access structure, the algorithm decrypts the ciphertext and returns ; S82. Verification link: ; like ,return ; like ,return ; like ,return ; ； like , returns 0; ； like , returns 1, otherwise returns 0.

Images