A blockchain-based transaction privacy protection system and method

Abstract

This invention discloses a blockchain-based transaction privacy protection system and method, including a participant node module, a transaction construction module, and a dynamic monitoring module. The participant node module consists of N bank nodes, each generating a Schnorr signature key pair, where the public key verifies the bank node's identity during transactions. The transaction construction module uses Pedersen commitments to hide transaction amounts, generating commitments and introducing non-interactive zero-knowledge proofs. The dynamic monitoring module uses a consensus mechanism to dynamically elect a monitoring node from the N bank nodes. The monitoring node initiates monitoring requests to target nodes, verifies the consistency of returned data with the distributed ledger, and revokes the monitoring node's monitoring authority upon completion of the monitoring task. Compared to previous models that introduced third-party monitors, this invention offers higher security and is better suited for distributed system architectures.

Description

Technical Field

[0001] This invention relates to the field of transaction privacy protection technology, and more specifically, to a blockchain-based transaction privacy protection system and method. Background Technology

[0002] As a distributed and immutable electronic ledger, blockchain offers transparency, security, and traceability in transactions, enabling verification even in environments where multiple parties distrust each other, demonstrating immense commercial value and leading to its widespread application in the Industrial Internet. While these advantages have fueled the rapid development of blockchain-related applications, the fact that distributed ledgers support verification of transactions by all participants is both their primary strength and weakness. This is because it means that all nodes on the chain have access to publicly available information, inevitably posing a risk of transaction privacy breaches. This can severely threaten transaction participants and even the entire transaction system, hindering the application and expansion of blockchain technology in the Industrial Internet.

[0003] In smart contract-based systems like Ethereum, transactions not only contain payment details but also embed code that makes function calls to specific programs, making the harm caused by privacy breaches even more serious.

[0004] Due to its distributed structure and traceable, immutable nature, blockchain has recently garnered widespread attention in both academia and industry. However, the transparency of blockchain transaction information is a double-edged sword. On the one hand, nodes in the blockchain system can effectively verify and monitor the legality of transactions; on the other hand, any node can directly access transaction-related information, posing significant security risks.

[0005] Some existing technologies have conducted research on privacy protection in blockchain transactions. For example, in Zerocash, to protect transaction privacy, during a transaction, some old currency is consumed and new currency is generated according to certain rules. The currency does not circulate directly in the system but is transferred to the newly generated currency through equivalent substitution. The old currency is identified by a serial number, and the new currency's legitimacy is ensured by related commitments. This effectively protects the transaction amount and the information of both parties involved. ZEXE extends the currency circulating in the blockchain system to any data layer. What circulates in the blockchain is no longer currency in the narrow sense, but valuable data in a broad sense, promoting the integration of blockchain with other fields. Furthermore, the ZEXE system uses the Zerocash infrastructure, thus also possessing strong privacy protection capabilities. In Ethereum and other smart contract-based systems, the security of Ethereum and smart contracts has recently become a hot research topic.

[0006] Several existing technologies support system oversight while maintaining privacy. zkledger utilizes Pedersen commitments to hide transaction amounts. Furthermore, specific commitment values ​​are calculated for nodes not involved in the transaction, preventing direct visualization of which nodes participated in the transaction on the ledger and thus protecting participant information. Further, due to the homomorphic nature of Pedersen commitments, combined with non-interactive zero-knowledge proofs (NIZK), transactions can be verified without knowing the details, enabling oversight while maintaining privacy. Due to the characteristics of zero-knowledge proofs, they have recently seen widespread application in blockchain technology. As an extension of Hyperledger Fabric, FabZK provides API interfaces that enable transaction data privacy protection in client and blockchain code. Similar to zkledger, FabZK also uses Pedersen commitments and zero-knowledge proofs to achieve privacy protection while supporting regulation. However, unlike zkledger, FabZK is used in the Hyperledger Fabric application scenario and utilizes additional proof and verification mechanisms during verification to improve regulatory performance.

[0007] However, the aforementioned regulatory functions are all implemented by introducing third-party nodes, and all operations are based on the premise that these third-party nodes are trustworthy. If the third-party nodes are untrustworthy, the entire system's resource data may be maliciously leaked. A third-party risk management research report indicated that 50% of surveyed organizations experienced system outages and third-party data breaches in 2021 due to untrustworthy third parties. Even trusted third parties are vulnerable to attack. While some existing technologies utilize trusted hardware for protection, this also introduces new trusted hardware issues and additional system maintenance costs. Summary of the Invention

[0008] This invention addresses the limitations of third-party monitoring nodes by constructing a blockchain-based transaction privacy protection and monitoring system. While protecting blockchain transaction privacy, it dynamically allocates monitoring permissions without introducing additional nodes. Furthermore, monitoring permissions can be securely revoked after the monitoring operation is completed. Any node in the system may be assigned monitoring permissions, ensuring a dynamic balance between the permissions and obligations of all nodes in the decentralized blockchain structure.

[0009] To achieve the above objectives, the first aspect of the present invention provides a blockchain-based transaction privacy protection system, comprising: The participant node module includes N bank nodes. Each bank node generates a Schnorr signature key pair. The public key in the Schnorr signature key pair is broadcast to other bank nodes for use in verifying the identity of the bank nodes during the transaction process. The transaction building module is used to hide the transaction amount using Pedersen commitments, generate commitments, and introduce non-interactive zero-knowledge proofs. The commitments for the transaction amount and the non-interactive zero-knowledge proofs are stored as transaction information in the distributed ledger. The dynamic supervision module is used to dynamically elect a supervisory node from N bank nodes using a consensus mechanism. The supervisory node initiates a supervision request to the target node and verifies the consistency of the returned data with the distributed ledger. After the supervision task is completed, the supervisory node's supervision authority is revoked.

[0010] In one implementation, a Pedersen commitment is used to hide the transaction amount, generating a commitment value, including: Set up a cyclic group and two random generators and ; Randomly select blinding factor A commitment to generate a transaction amount m .

[0011] In one implementation, the distributed ledger is stored in a table structure, with each row corresponding to a transaction and each column corresponding to the transaction information of a bank node. The transaction information also includes vouchers, which are calculated based on the public key and the blind factor.

[0012] In one implementation, the introduction of non-interactive zero-knowledge proofs to verify asset scope, break-even, and transaction consistency includes: Construct a triple ,in This indicates proof of the scope of assets. This indicates proof of a balance of payments. This represents a proof of consistency. The asset amount of bank nodes is constrained by the asset scope proof; The balance sheet is used to verify the balance between the transfer in and transfer out of the transaction assets. The consistency of the blind factor in the commitment value and the blind factor in the voucher is verified through the consistency proof verification.

[0013] In one implementation, asset limits are imposed on bank nodes using asset scope proofs, including: Analyze the transactions of the bank nodes that initiate transactions in the distributed ledger; The asset scope proof ensures that the amount spent in the transaction does not exceed the total assets.

[0014] Based on the same inventive concept, a second aspect of this invention provides a blockchain-based transaction privacy protection method, comprising: A bank node creates a transaction, hides the transaction amount using a Pedersen commitment, generates a commitment, and introduces a non-interactive zero-knowledge proof. The commitment to the transaction amount and the non-interactive zero-knowledge proof are stored as transaction information in the distributed ledger. A consensus mechanism is used to dynamically elect a regulatory node from N bank nodes. The regulatory node then initiates a regulatory request to the target node and verifies the consistency of the returned data with the distributed ledger. Revoke the regulatory authority of the regulatory node after the regulatory task is completed.

[0015] In one implementation, a consensus mechanism is used to dynamically elect a regulatory node from N bank nodes, including: Select a bank node as the elector node and broadcast the elector node's information to other bank nodes. The elector node's information includes the vote initiation signal, the current election round, the node signature, and the tag calculated by the node using the current time. Other bank nodes verify the node signature and current election round of the elector node. If the verification is successful, they combine the current election round, their own ID and signature with the tag obtained by themselves through the current time to form a response message and broadcast it. The elector nodes verify the signature in the response message. If the verification passes, they record the mark obtained by each node at the current time and calculate an intermediate value based on the mark obtained by each node at the current time. If all other nodes' flags are received or more than a preset proportion of nodes have returned a response by the time the set response time has expired, count the frequency of the median value and select the node with the highest frequency as the selected node. The elector nodes will broadcast the election results; Other nodes verify the signatures in the election results information, and the selected node is granted supervisory authority.

[0016] In one implementation, the intermediate value is calculated as follows: q=

[0017] in, The markers calculated by other nodes using the current time. Let q be the total number of bank nodes, and q be the median value.

[0018] In one implementation, the process of a supervisory node initiating a supervisory request to the target node and verifying the consistency of the returned data with the distributed ledger includes: The supervisory node sends a supervisory request to the supervised node. The supervisory request carries the signal to perform the supervisory operation, the current supervisory round, the supervisory node's signature, and the time of the supervisory operation. Upon receiving a regulatory request, the regulated node verifies the signature of the regulatory node and the correctness of the current regulatory round in the request. If the verification is successful, the regulated node returns the data required for regulation, including the assets owned by the regulated node, the quantity of all non-zero transactions, vouchers related to the blind factor in the Pedersen commitment, and proof of the legality of the transaction funds, combined with the current regulatory round information and its own... The response information, consisting of the signature, is returned to the monitoring node. The regulatory node verifies the correctness of the signature in the response information. If the verification is correct, the regulatory node checks the returned data of the regulated node through the information recorded in the distributed ledger. If the verification is correct, the node's transaction passes the supervision; otherwise, it indicates that there is a problem with the node's funds and outputs the corresponding result.

[0019] In one implementation, revoking the regulatory authority of the regulatory node after the regulatory task is completed includes: The regulatory node will broadcast a request to revoke regulatory authority. This request includes a revocation signal, the current round of revocation, the regulatory node's signature, and the time when the revocation operation was performed. After receiving the broadcast message, other nodes verify the correctness of the supervisory node signature in the broadcast and the current round of supervisory revocation. If the verification is correct, they will update the current round of supervisory revocation and their own signature. Signature and signals allowing the revocation of supervisory authority The response information is broadcast. The supervisory node verifies the correctness of the signature in the broadcast message from other nodes. If the verification is successful, it records the nodes that have responded. ; If the supervisory node receives acceptance messages from all other nodes or if more than a preset proportion of nodes have returned responses within the set response time, the supervisory node broadcasts a successful revocation message; otherwise, it outputs a revocation operation failure message. Other nodes verify the signature in the successful revocation message. If the verification is correct, they do not continue to respond to regulatory information from the regulatory nodes in the current regulatory round.

[0020] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows: This invention discloses a blockchain-based transaction privacy protection system, comprising a participant node module, a transaction construction module, and a dynamic monitoring module. In the participant node module, bank nodes generate Schnorr signature key pairs, and the public key in the Schnorr signature key pairs is broadcast to other bank nodes to verify the identity of the initiating bank node. The transaction construction module uses Pedersen commitments to hide the transaction amount, generating commitments and introducing non-interactive zero-knowledge proofs. The dynamic monitoring module uses a consensus mechanism to dynamically elect a monitoring node from N bank nodes. The monitoring node initiates a monitoring request to the target node and verifies the consistency of the returned data with the distributed ledger. After the monitoring task is completed, the monitoring node's monitoring authority is revoked. This invention applies a combination of homomorphic Pedersen commitments and non-interactive zero-knowledge proofs in the privacy protection process, protecting transaction privacy while supporting the monitor's verification of transactions. Furthermore, for the setting of the monitor in the decentralized structure, a monitoring authority allocation and revocation algorithm is used to dynamically select the monitor in the system, achieving monitoring without introducing any other third-party nodes, thus increasing the system's security. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a block diagram of a blockchain-based transaction privacy protection system in an embodiment of the present invention; Figure 2 This is an architecture diagram of a blockchain-based transaction privacy protection system in an embodiment of the present invention; Figure 3 for Figure 2 A schematic diagram of the system's operation; Figure 4 This is a time consumption diagram for a complete transaction in an embodiment of the present invention; Figure 5 A comparison chart of time consumption before and after supervision is added to the embodiments of the present invention; Figure 6 This is a comparison chart of the time consumption of the system and other models in this embodiment of the invention. Detailed Implementation

[0023] As a distributed and immutable electronic ledger, blockchain offers transparency, security, and traceability in transactions, enabling verification even in environments where multiple parties distrust each other, demonstrating immense commercial value and leading to its widespread application in the Industrial Internet. While these advantages have fueled the rapid development of blockchain-related applications, the fact that distributed ledgers support verification of transactions by all participants is both their primary strength and weakness. This is because it means that all nodes on the chain have access to publicly available information, inevitably posing a risk of transaction privacy breaches. This can severely threaten transaction participants and even the entire transaction system, hindering the application and expansion of blockchain technology in the Industrial Internet.

[0024] This invention addresses the conflict between privacy protection and regulation in the decentralized structure of blockchain by designing a blockchain transaction privacy protection and regulation model. It implements regulatory operations while ensuring blockchain transaction privacy, without introducing any third-party nodes. In the proposed model, based on the decentralized structure of blockchain, nodes in the system not only act as participants and verifiers in transactions but are also assigned regulatory authority to act as regulators. Each node has equal rights and obligations, fully leveraging the advantages of the decentralized structure to maintain system stability.

[0025] This invention draws on the idea of ​​protecting information privacy through encryption algorithms, but instead uses the homomorphic Pedersen commitment. When a transaction occurs, the commitment value corresponding to the transaction data is calculated before being sent out. Since transaction information is not directly public, proofs are needed to guarantee the data in the transaction. At the regulatory level, the homomorphism of Pedersen commitments allows for transaction verification without knowing the specific transaction data. Furthermore, this invention uses a regulatory authority allocation algorithm to allow regulatory authority to flow among participants without introducing additional nodes, thus improving the model's security.

[0026] The main contributions of this invention are as follows: (1) A blockchain transaction privacy protection and supervision model (system) was designed to ensure the distributed structure of the system while finding a balance between the contradictory issues of blockchain transaction privacy protection and supervision.

[0027] (2) The system uses a combination of Pedersen commitments and non-interactive zero-knowledge proofs to protect sensitive information such as transaction amount, transaction participants, and transaction flow graph, and to supervise the distributed ledger.

[0028] (3) An algorithm for allocating regulatory authority was proposed, which dynamically selects regulators from among the participants, avoids the introduction of additional third-party nodes, increases the security of the model, and ensures the decentralized structure of the model.

[0029] Example 1 This embodiment provides a blockchain-based transaction privacy protection system. Please refer to [link / reference]. Figure 1 ,include: The participant node module 101 includes N bank nodes. Each bank node generates a Schnorr signature key pair. The public key in the Schnorr signature key pair is broadcast to other bank nodes for use in verifying the identity of the bank nodes during the transaction process. The transaction construction module 102 is used to hide the transaction amount using Pedersen commitments, generate commitments, and introduce non-interactive zero-knowledge proofs. The commitments for the transaction amount and the non-interactive zero-knowledge proofs are stored as transaction information in the distributed ledger. The dynamic supervision module 103 is used to dynamically elect a supervision node from N bank nodes using a consensus mechanism. The supervision node initiates supervision requests to the target node and verifies the consistency of the returned data with the distributed ledger. After the supervision task is completed, the supervision node's supervision authority is revoked.

[0030] Specifically, the system of this invention utilizes Pedersen commitments to encrypt transaction information, achieving privacy protection, and then combines this with non-interactive zero-knowledge proofs to provide conditions for supervision. The supervisor is a node in the system dynamically assigned supervisory authority through a supervisory authority allocation algorithm, temporarily assuming the role without requiring any third-party nodes, and is securely revoked after the supervisory task is completed. The overall model architecture is as follows: Figure 2 As shown.

[0031] To enable the system in this invention to protect transaction privacy while supporting supervision, relevant designs were implemented for transactions between nodes in the system. The key technologies used in constructing transactions are as follows: 1) Commitment Plan To protect privacy, transaction participants do not disclose details such as transaction amounts, but instead submit these to the ledger after concealing them through relevant commitments.

[0032] The Pedersen commitment is used in this invention, assuming It contains A cyclic group of elements, and These are two of the random generators, when the integer At that time, blinding factors are randomly selected. Promises can be built . According to the construction of the Pedersen commitment, it can be known that, based solely on... It is impossible to obtain The information. Pedersen commitments have additive homomorphism if and Each corresponds to an integer , and blinding factor , The promise, then If there is Then there is , This property can be used to verify relevant parameters without knowing their specific values.

[0033] 2) Public key encryption The model in this invention is based on a distributed ledger, and in this implementation, participants are banks. For example, for each Each will generate a key containing a private key. and public key The Schnorr signature key pair consists of, where Then the public key The public key is sent to all other participants in the system; in this model, it is used to verify the bank's identity during the transaction process.

[0034] 3) Non-interactive zero-knowledge proofs To ensure effective protection of transaction privacy and regulation, this invention also utilizes non-interactive zero-knowledge proofs. Non-interactive zero-knowledge proofs refer to proofs where the prover, without interacting with the verifier, does not provide any information related to the conclusion to convince the verifier that the conclusion is correct. In this model, relevant proofs are provided for the scope of bank assets, balance of payments, and consistency.

[0035] The security objective of the model proposed in this invention is to maintain a verifiable transaction ledger while concealing transaction amounts, participants, and relationships between transactions, ensuring that regulators can obtain reliable answers to their queries. Specifically, banks publish transactions with hidden details, yet these transactions can still be verified by other participants in the system. Furthermore, the model in this invention can also hide the transaction flow graph, thereby resisting side-channel attacks carried out by analyzing transaction flows.

[0036] During oversight, the regulator sends a regulatory request, and the corresponding regulated node responds. The regulator verifies that the data in the response matches the data recorded on the distributed ledger. Furthermore, the regulator is dynamically selected using a regulatory permission allocation algorithm, without introducing any other third-party nodes. After completing the regulatory task, the regulator's permissions are securely revoked, effectively preventing single points of attack and protecting the system's distributed structure.

[0037] Participants in the system, using banks as an example in this invention, may attempt to steal or hide assets, manipulate account balances, or falsify data to regulators, and banks may collude with each other. In the model proposed in this invention, as long as the two parties involved in the transaction do not collude with the regulator, the transaction amount and the privacy of the participants can be protected. In the model proposed in this invention, regulatory authority is dynamically allocated, and due to the distributed structure, after a certain number of rounds, every participant could potentially become a regulator. Therefore, the possibility of a malicious participant colluding with the regulator is very small, unless they collude with all nodes in the system, which would defeat the purpose.

[0038] like Figure 3 As shown, the distributed ledger transaction privacy protection and regulatory model mainly consists of three components: 1) Transaction participants: There are n participants. In this implementation, taking a bank as an example, we use... This is represented by the following: Bank-to-bank transfer transactions occur and are recorded in the ledger. Within a certain timeframe, a bank is elected as the regulator to oversee the assets held by bank accounts within the system at that time. Once the regulatory task is completed, the regulator's permissions are released until the next regulatory operation is needed, at which point regulatory permissions are dynamically allocated using a regulatory permission allocation algorithm.

[0039] 2) Transaction Information: Banks facilitate the flow of currency by establishing transactions to exchange assets. A transaction refers to... Towards Initiate a transfer of amount m, where transaction details are hidden using a commitment method to protect transaction privacy. The proposed solution supports transferring funds to multiple other banks simultaneously; however, for simplicity, in practice, it is assumed that each transaction has only one sending bank and one receiving bank.

[0040] 3) A ledger for recording transaction information: Banks must record all transactions in a single ledger. This ledger can only be expanded, ensuring that any changes in asset ownership are recorded in the ledger without deletion. Regulators compare the data recorded in the ledger with the information provided by the bank to ensure that the bank is not hiding assets.

[0041] Interbank transactions incorporate commitments and zero-knowledge proofs to protect transaction privacy and verify the legitimacy of fund sources. Once a transaction is confirmed, it is updated in the ledger. Participants in the system are dynamically selected as regulators, who oversee them based on the transaction data recorded in the ledger.

[0042] Using Pedersen commitments to hide the transaction amount, a commitment value is generated, including: Set up a cyclic group and two random generators and ; Randomly select blinding factor A commitment to generate a transaction amount m .

[0043] The distributed ledger uses a table structure for storage, with each row corresponding to a transaction and each column corresponding to the transaction information of a bank node. The transaction information also includes vouchers, which are calculated based on public keys and blind factors.

[0044] Specifically, the ledger in the model is a table structure, where each row corresponds to a transaction and each column corresponds to a bank's transaction information. Table 1 shows an example of the data format corresponding to a transaction recorded in the ledger.

[0045] As can be seen from Table 1, when Towards When transferring 1000 yuan, as a participant in the transaction, and Build commitments separately and This is to protect the transaction amount. Other non-participating parties also have committed values ​​in their respective banks. In this way, for each transaction record, each participant in the ledger system will have a commitment value, thus hiding the two parties involved in the transaction. Then, for each bank, the corresponding column also includes information related to the blinding factor in the commitment. Related to proof of asset scope, proof of income and expenditure balance, and proof of consistency. As can be seen from the structure of the ledger, each bank's corresponding column contains all of that bank's transaction information, thus allowing for the verification of a bank's assets through calculation.

[0046] The transaction construction process reveals that this model uses Pedersen commitments instead of plaintext transaction amounts, making it impossible for outsiders to distinguish whether the committed amount is positive, negative, or zero. Each transaction contains the commitment values ​​from n banks, forming a vector of n elements. For banks that did not participate in the transaction, v=0 in their corresponding commitments, but each commitment uses a different blinding factor r, making the value of the commitment indistinguishable to the outside world.

[0047] During transactions, the system must ensure that assets cannot be created or destroyed out of thin air, and that there are sufficient funds to support the transactions. In public blockchains, current or historical transactions can be directly viewed to verify that the bank has sufficient funds. However, in the system proposed in this invention, these values ​​are not directly public. Instead, relevant proofs are constructed to ensure that the bank's assets are sufficient for transactions.

[0048] Specifically, non-interactive zero-knowledge proofs are introduced to verify asset scope, break-even, and transaction consistency, including: Construct a triple ,in This indicates proof of the scope of assets. This indicates proof of a balance of payments. This represents a proof of consistency. The asset amount of bank nodes is constrained by the asset scope proof; The balance sheet is used to verify the balance between the transfer in and transfer out of the transaction assets. The consistency of the blind factor in the commitment value and the blind factor in the voucher is verified through the consistency proof verification.

[0049] This includes constraining the asset amount of bank nodes through asset scope proof, including: Analyze the transactions of the bank nodes that initiate transactions in the distributed ledger; The asset scope proof ensures that the amount spent in the transaction does not exceed the total assets.

[0050] Specifically, this invention introduces methods to represent proof of asset scope, proof of income and expenditure balance, and proof of consistency. To ensure the system's privacy protection and oversight functions during normal transaction operation, among which It is a triple, in the form of ,in This indicates proof of the scope of assets. This indicates proof of a balance of payments. This represents a proof of consistency.

[0051] First, the model must ensure that the banks conducting the transactions have sufficient assets; therefore, an asset scope proof is introduced. Previous blockchain systems used UTXOs (Unspent Transactions Outputs) to represent assets and prevent double-spending. While this made all currencies traceable and funds more transparent, it also revealed transaction flow graphs, creating security vulnerabilities. In the model of this invention, all transactions are recorded in a ledger. Banks prove their assets by calculating the transaction amount in their corresponding columns; if the bank's assets exceed the transaction amount, it demonstrates the bank's payment capacity. Since the construction of commitments relies on a cyclic group, it is assumed... Let be the order of the cyclic group. According to the properties of cyclic groups, we have: If the transaction amount is not guaranteed Malicious banks may create assets out of thin air.

[0052] To address this issue, this implementation employs a range proof method based on Borr-omean ring signatures for Confidential Assets to constrain bank asset amounts. According to the definition above, a range proof is required between the amount used to generate a single transaction and the total transaction amount in the column. During inter-bank transactions, the transaction initiator first needs proof of its assets—that is, analysis of the bank's transaction data in the ledger—and then compares the transaction expenditure with the total assets, ensuring that the transaction amount does not exceed the total assets.

[0053] Assets in the system cannot be created or destroyed out of thin air. This is proof of a balance between income and expenditure, used to protect the balance between the transfer of assets in and out of a transaction. For each transaction, the submitted confirmed transaction value should meet the following requirements: ,in For bank serial numbers, This represents the total number of banks. To verify this condition, a blinding factor was selected. When it is satisfied Thus, for each transaction, using the homomorphism of Pedersen commitments, we calculate whether the value of the corresponding row in the ledger satisfies [the following condition]. This will provide proof of income and expenditure balance. .

[0054] Once a transaction is created, the bank broadcasts it. Each bank must confirm the transaction before accepting it, and once confirmed, the transaction is recorded in the ledger.

[0055] Table 1 Towards The contents of the ledger when transferring 1000 yuan.

[0056] In Table 1, TX ID represents the transaction ID, Currency represents the currency type, and Time represents the transaction time. , These represent the 1st and nth bank nodes, respectively.

[0057] Example 2 Based on the same inventive concept, this embodiment discloses a blockchain-based transaction privacy protection method, including: S1: A bank node creates a transaction, hides the transaction amount using a Pedersen commitment, generates a commitment, and introduces a non-interactive zero-knowledge proof. The commitment of the transaction amount and the non-interactive zero-knowledge proof are stored as transaction information in the distributed ledger. S2: A consensus mechanism is used to dynamically elect a supervisory node from N bank nodes. The supervisory node then initiates a supervisory request to the target node and verifies the consistency of the returned data with the distributed ledger. S3: Revoke the regulatory authority of the regulatory node after the regulatory task is completed.

[0058] Specifically, a consensus mechanism is used to dynamically elect a regulatory node from N bank nodes, including: Select a bank node as the elector node and broadcast the elector node's information to other bank nodes. The elector node's information includes the vote initiation signal, the current election round, the node signature, and the tag calculated by the node using the current time. Other bank nodes verify the node signature and current election round of the elector node. If the verification is successful, they combine the current election round, their own ID and signature with the tag obtained by themselves through the current time to form a response message and broadcast it. The elector nodes verify the signature in the response message. If the verification passes, they record the mark obtained by each node at the current time and calculate an intermediate value based on the mark obtained by each node at the current time. If all other nodes' flags are received or more than a preset proportion of nodes have returned a response by the time the set response time has expired, count the frequency of the median value and select the node with the highest frequency as the selected node. The elector nodes will broadcast the election results; Other nodes verify the signatures in the election results information, and the selected node is granted supervisory authority.

[0059] Specifically, oversight is a crucial component of system security. In distributed ledger systems, monitoring and controlling participant assets is essential. However, due to the unique structure of distributed ledgers, implementing oversight functions presents challenges. Previous methods involved introducing third-party regulatory bodies, which operate outside the system's transaction process. When monitoring transactions and participants' funds, security cannot be guaranteed.

[0060] This implementation proposes a dynamic allocation algorithm for supervisory authority, which directly selects supervisory nodes from among the system participants and assigns them supervisory authority. After the supervisory operation is completed, the supervisory authority can be revoked using a supervisory authority revocation algorithm. When the next supervisory operation is performed, a new supervisor is selected. The specific algorithm is as follows.

[0061] Regulatory authority allocation algorithm Input: Each account node in the blockchain Total number of nodes

[0062] Output: The account nodes selected and granted regulatory authority

[0063] (1) Select number as The node is denoted as To make it transmit information Broadcast to other nodes, Signaling the start of voting The number of rounds to be performed, with an initial value of 1. For the node number, For the signature of the node, The tag for the node calculated using the current time; (2) Other nodes verify the broadcast information after receiving it. Node signature and current The correctness; (3) If the verification is correct, other nodes will move to the current round. , one's own and signature Compared with the mark obtained through the current time The information is combined into a first response message and broadcast. The first response message is... ; (4) The node verifies the correctness of the signature in the broadcast message from other nodes; (5) If the verification is correct, Each node records the information of each node. And calculate the intermediate value: ; (6) If all other nodes receive Or, if more than 2 / 3 of the nodes have returned a response after the set response time has expired, statistics are available. The frequency of occurrence, with the highest frequency value corresponding to the selected node number to which regulatory authority is to be assigned, is denoted as . Otherwise, this round will end in a stalemate. Add 1; (7) The node transmits the election results via information. Broadcast it; (8) The signature in the verification information of other nodes, the selected node is granted supervisory authority and recorded as And perform the relevant operations, the remainder including Including nodes to do well with Preparation for interaction.

[0064] Specifically, the supervisory node initiates a supervisory request to the target node and verifies the consistency of the returned data with the distributed ledger, including: The supervisory node sends a supervisory request to the supervised node. The supervisory request carries the signal for performing the supervisory operation, the current supervisory round, the supervisory node's signature, and the time of the supervisory operation. Upon receiving a regulatory request, the regulated node verifies the signature of the regulatory node and the correctness of the current regulatory round in the request. If the verification is successful, the regulated node returns the data required for regulation, including the assets owned by the regulated node, the quantity of all non-zero transactions, vouchers related to the blind factor in the Pedersen commitment, and proof of the legality of the transaction funds, combined with the current regulatory round information and its own... The response information, consisting of the signature, is returned to the monitoring node. The regulatory node verifies the correctness of the signature in the response information. If the verification is correct, the regulatory node checks the returned data of the regulated node through the information recorded in the distributed ledger. If the verification is correct, the node's transaction passes the supervision; otherwise, it indicates that there is a problem with the node's funds and outputs the corresponding result.

[0065] Specifically, regulators need to interact with nodes in the system and monitor the bank's assets, the number of illegal transactions, and the monetary composition of the bank's assets based on transaction records in the ledger. Previous studies have exercised regulatory power by introducing third-party regulators, but the presence of a regulator within the distributed system of blockchain increases overhead and security risks.

[0066] The model proposed in this invention dynamically selects regulators in the system through a regulatory authority allocation algorithm. Based on the characteristics of the nodes in the system that support interaction and querying transaction records in the ledger, the regulatory authority is dynamically allocated using the consensus of the nodes in the system. Each node has an equal probability of being selected. After a round of regulatory operations is completed, the regulatory authority is safely released until there is another regulatory need, at which point a regulator is dynamically selected again.

[0067] When regulators execute regulatory actions, they issue regulatory requests to the relevant banks. After confirming the information, the banks respond to the regulators, proving that their financial situation matches the records in their ledgers. The regulators then calculate the relevant data listed in the bank's ledgers and compare it with the information in the bank's response. If the comparison is successful, the bank passes the regulatory process. The specific algorithm is shown below.

[0068] Transaction monitoring algorithm Input: Regulatory node Regulated nodes Total number of nodes ledger

[0069] Output: Regulatory Results (1) Regulatory nodes Send a regulatory request to the regulated node, the request is ,in 'e' is a signal to execute regulatory actions. The number of rounds to be performed, with an initial value of 1. For the regulator's signature, The timing of this regulatory action; (2) After receiving the regulatory request, the regulated node verifies the information in the data. Node signature and current The correctness; (3) If the verification is correct, the node returns the data required for supervision, including the assets it currently owns. All non-zero quantities involved in the transactions The blinding factor related to the Pedersen commitment in the transaction And proof of the legality of the transaction funds. Combined with the information of the current round one's own and signature Composition information Return to the regulatory node ; (4) The node verifies the correctness of the signature in the returned information; (5) If the verification is correct, Nodes via ledger The information recorded in the system is used to verify whether the data returned by the regulated node is correct. If the verification is correct, the node's transaction passes the supervision; otherwise, it indicates that there is a problem with the node's funds and the corresponding result is output. (6) Repeat the above steps until all nodes have passed the regulatory operation.

[0070] Specifically, banks can collude to temporarily hold assets for each other, for example... It is possible that some assets will be transferred to And will be recovered subsequently; during this period, these assets will become It is part of a holding company. However, after regulators raised questions because the request contained corresponding time information... To conduct another transaction, it would be within a certain timeframe. After that. Regarding Previous transactions are verified and the corresponding information is recorded in the ledger, making it impossible for malicious banks to collude, as it is too late to create a new transaction to transfer assets to another bank. This increases the security of the system and demonstrates the necessity of regulation.

[0071] In the model proposed in this invention, every transaction affects every participant because, in the model setup, even non-participating banks are recorded in the ledger. The commitment is made, and during supervision, regulators need to calculate and verify all commitment values ​​in the corresponding column. Therefore, if a transaction created by a malicious user is not disclosed to other banks in the system, the commitment value in the column representing those other banks will be problematic and will fail to pass supervision.

[0072] To ensure the integrity of transactions, this model requires all banks to have sufficient information to prove the legality of their commitments to regulators. This necessitates adding a record to the bank's logbook for each transaction. Regulators can use (Documents) are used to verify commitments without needing to know the blinding factor chosen by the bank when constructing the commitment.

[0073] When regulating the system, due to the nature of Pedersen's commitment, regulators can directly require banks to provide [relevant information]. and Through calculation The value is used to regulate transactions. However, in the process of regulation, bank assets... It needs to be verified; the blind factor in trading. This is determined by the bank initiating the transaction, so the bank may not be aware of all the blinding factors used in the commitments, meaning... Unable to determine.

[0074] Therefore, the model in this invention requires the sender of the transaction to encrypt and publish the blinding factor, facilitating decryption and access to the blinding factor by other non-transactional participating banks during subsequent regulatory operations. To ensure the validity of the encrypted information regarding the blinding factor, a zero-knowledge proof is introduced to ensure consistency between the value of the blinding factor used in the encryption and the value of the blinding factor in the commitment. For a bank It does not need to be disclosed. To prove That's correct, if there's a commitment value. The bank can calculate it. and The value, which regulators can calculate from the ledger. , and The value. Thus, the bank only needs to prove... You can do it without knowing In order to obtain the information required by regulators in the circumstances. The blind factor in the middle and the commitment are consistent, and this implementation introduces a consistency proof. This is to prevent malicious banks from adding transactions to the ledger without authorization, which would prevent other banks from verifying the commitment of these transactions.

[0075] Specifically, revoking the regulatory authority of a regulatory node after the regulatory task is completed includes: The regulatory node will broadcast a request to revoke regulatory authority. This request includes a revocation signal, the current round of revocation, the regulatory node's signature, and the time when the revocation operation was performed. After receiving the broadcast message, other nodes verify the correctness of the supervisory node signature in the broadcast and the current round of supervisory revocation. If the verification is correct, they will update the current round of supervisory revocation and their own signature. Signature and signals allowing the revocation of supervisory authority The response information is broadcast. The supervisory node verifies the correctness of the signature in the broadcast message from other nodes. If the verification is successful, it records the nodes that have responded. ; If the supervisory node receives acceptance messages from all other nodes or if more than a preset proportion of nodes have returned responses within the set response time, the supervisory node broadcasts a successful revocation message; otherwise, it outputs a revocation operation failure message. Other nodes verify the signature in the successful revocation message. If the verification is correct, they do not continue to respond to regulatory information from the regulatory nodes in the current regulatory round.

[0076] Specifically, in order to dynamically allocate regulatory permissions, for nodes that have been granted regulatory permissions, their permissions need to be securely revoked after they have completed their regulatory tasks, to ensure that the next round of regulatory permission allocation can proceed normally. The specific algorithm is as follows.

[0077] Algorithm for Revoking Regulatory Authority Input: Account nodes with regulatory authority Each account node in the blockchain Total number of nodes

[0078] Output: Result of revocation of supervisory authority (1) Account nodes with regulatory authority Request to revoke regulatory authority Broadcast it. This is a signal to revoke regulatory authority. The number of rounds to be performed, with an initial value of 1. For the regulator's signature, The moment when the undo operation is performed; (2) Other nodes verify the broadcast information after receiving it. Node signature and current The correctness; (3) If the verification is correct, the node will send the current round information. one's own ,sign And signals that allow the revocation of regulatory authority Composition information Broadcast it; (4) The node verifies the correctness of the signature in the broadcast message from other nodes; (5) If the verification is correct, The node records the nodes that have responded. ; (6) If all other nodes receive Or, if more than 2 / 3 of the nodes have returned a response by the time the set response time has expired, then... Broadcast cancellation successful , If it is a signal indicating that the undo operation has been completed, then output a message indicating that the undo operation failed and attempt to retry, returning to ①. (7) The signature in the verification information of other nodes, once verified as correct, does not require further response in the current node. In Regulatory information.

[0079] (8) Output a message indicating successful cancellation. Add 1.

[0080] The algorithm proposed in this invention will be analyzed below. When introducing oversight functionality into a distributed ledger, it's crucial to minimize disruption to the system's fundamental features. In previous models that introduced third-party oversight nodes, these nodes existed directly within the system, independent of other nodes. This primarily leads to security and overhead issues, failing to fully leverage the advantages of the distributed architecture.

[0081] The solution in this invention has the following advantages compared to solutions that introduce third-party monitoring nodes: 1) In regulatory schemes that introduce third-party nodes, the trustworthiness of these nodes is controversial. Third-party nodes exist continuously throughout the system's operation, performing only regulatory tasks, but can interact with other nodes and obtain corresponding data, increasing the risk of privacy breaches. In a distributed structure like blockchain, the permissions and obligations of each node should be equal. Third-party regulatory nodes, existing within the system yet independent of the distributed structure, undermine the security maintained by the distributed structure. The scheme proposed in this invention, however, allows regulatory permissions to flow within the system, with each node receiving an equal probability, ensuring a dynamic balance of node permissions. Regulatory operations are directly undertaken by participants within the system, eliminating the trust issues associated with introducing third-party nodes. 2) Introducing third-party oversight nodes introduces additional security issues. The method proposed in this invention directly selects oversight nodes from among the participants, relying on the decentralized structure of blockchain to ensure system security. However, in schemes introducing third-party oversight nodes, the security of these nodes must be considered. Third-party nodes, operating independently of the distributed structure and performing simple, single-point operations for extended periods, are highly vulnerable to single-point attacks. The security of third-party nodes is directly related to the attack resistance capabilities of the third-party organization, which is an uncontrollable factor. Existing technical solutions use trusted hardware to enhance security, but this also introduces new trusted hardware issues and additional system maintenance costs. The solution proposed in this invention, however, eliminates these problems because it does not involve third-party nodes.

[0082] This invention draws inspiration from the Practical Byzantine Fault Tolerance (PBFT) protocol and utilizes consensus mechanisms to construct a supervisory authority allocation algorithm. The final decision is made based on the outputs of each node. To ensure fairness, this implementation uses the moment the request information is received as input to generate the corresponding decision output. While the PBFT protocol requires a client node to send the request, this implementation directly uses the current supervisory round to sequentially select the node that sends the request; this node is the one in the algorithm. It has no other special permissions; it is only used to send requests and collect the returned results. This information is public in the system and can be obtained and verified by all nodes.

[0083] For the selected monitoring nodes, the main monitoring operation involves interacting with other nodes to obtain relevant information and comparing it with the information previously recorded in the ledger. Since any node in the system can transact with other nodes and record these transactions in the ledger, directly granting monitoring permissions to nodes in the system is feasible.

[0084] To enable mutual supervision among nodes in the system and prevent collusion among a few, supervisory permissions need to circulate within the system. Therefore, after a round of supervisory verification is completed, the node's permissions must be revoked to prepare for the next round of reassignment. The supervisory permission revocation algorithm primarily informs the supervisory node that its task is complete and no further responses to its requests are required.

[0085] Security Analysis The security of the blockchain transaction privacy protection and supervision model designed in this invention is mainly analyzed from two aspects: the security of the scheme itself and the security of transactions during the operation of the model.

[0086] 1) The security of the model in this scheme is jointly guaranteed by the distributed structure of the blockchain and the consensus mechanism. In the distributed structure, participants supervise each other and make relevant decisions through the consensus mechanism. For the security of blockchain transaction privacy protection, the model in this scheme can provide security support at the blockchain network layer and transaction layer by using technologies such as Pedersen commitments and non-interactive zero-knowledge proofs. When allocating supervisory authority, an improved supervisory authority allocation algorithm based on the practical Byzantine algorithm is used, which retains the fault tolerance and provable security of the practical Byzantine algorithm. The corresponding proof process can be found in the reference Castro M, Liskov B. A correctness proof for a practical Byzantine-fault-tolerant replication algorithm[R]. Technical Memo MIT / LCS / TM-590, MIT Laboratory for Computer Science, 1999.

[0087] 2) The security of transactions during the model's operation is dually guaranteed by encryption technology and regulatory mechanisms. In the system proposed in this invention, the specific transaction amount is hidden within the Pedersen commitment calculation, making it impossible to directly obtain the specific transaction data even if the transaction information is leaked. Although the transaction amount cannot be directly obtained, the transaction process manifests as the addition and subtraction of the accounts of both parties. Utilizing the homomorphism of the Pedersen commitment, regulators can verify relevant transactions without knowing the transaction details. Furthermore, the method proposed in this invention, even when a bank is not involved in a transaction, will still include a commitment value of 0 in the corresponding column of the transaction record in the ledger. This makes it impossible for outsiders to identify the specific participants in each transaction, thereby resisting side-channel attacks through transaction flow graph analysis.

[0088] Experiments and Results To evaluate the model design, the experimental environment for this invention was configured with an Ubuntu 16.04 operating system, 16GB RAM, and an Intel Core i5-7400 3.00GHz CPU. Experiments were conducted using code written in Go. The model implementation is based on a modified btcec library, which includes the relevant parameters and methods for calculating elliptic curves, and utilizes Go's built-in SHA-256 to implement the cryptographic hash function. Range proofs use a confidential asset-based protocol, and non-interactive zero-knowledge proofs are based on Generalized Schnorr Proofs and the Fiat-Shamir transform.

[0089] The system in this invention primarily achieves two functions: transaction privacy protection and supervision. Therefore, the experiments were designed mainly based on these two points. For different numbers of traders, each experiment generated 100 transactions, and the time required to complete these transactions was compared. The specific experimental results and analysis are as follows.

[0090] 1. Transaction efficiency Unlike models where transactions are open and transparent, the model (system) in this implementation hides the transaction amount and participants in order to meet the requirements of privacy protection and supervision when constructing transactions. Figure 4 The figure shows the time required for a bank to generate 100 transactions in the model proposed in this invention, broadcast them, have them verified by other nodes, and then record them in the ledger. It can be seen that the average time required for each transaction is controlled within the millisecond range.

[0091] 2. The costs of introducing regulation The model proposed in this implementation uses Pederson commitments to protect transaction privacy and employs non-interactive zero-knowledge proofs to refine relevant details, thereby enabling the model to support regulation. When implementing regulation, a regulatory authority allocation algorithm is used to dynamically select regulators from among the system participants. Figure 5 The figure compares the time overhead of running the regulatory permission allocation algorithm and completing regulatory operations for 100 transactions in the ledger with the time overhead without regulation. It is clear from the figure that the regulatory mechanism in the proposed model has a minimal impact on time consumption. This is because the main source of overhead is the special design required during transaction construction, while the regulatory operation only requires selecting a regulator for relevant verification. Furthermore, the system of this invention does not introduce third-party regulatory nodes; regulatory permissions are dynamically allocated within the system, increasing the overall security of the model.

[0092] 3. Overall performance analysis This implementation method selects zkledger, a model that also supports privacy protection and oversight, for comparison. The results are as follows: Figure 6As shown, when there are few participants, the performance of the model in this invention is not significantly different from that of zkledger. However, as the number of banks increases, the model in this invention consumes slightly more time than zkledger. This is because zkledger introduces a third party as a regulator, increasing space overhead. In contrast, the regulatory authority in the model of this invention is dynamically allocated, and the corresponding time consumption lies in the algorithm for allocating and revoking regulatory authority.

[0093] In the solution proposed in this invention, the generation of a transaction includes a Pedersen commitment and a proof of consistency. ,in This method uses a range proof approach based on Borromean ring signatures in confidential assets to prove that the transaction value is within a specific range. Its memory usage and runtime consumption are significantly greater than Pedersen commitments and other proofs, making it the primary source of runtime time. A similar range proof approach is used in zkledger, so the time consumption of the two methods is not significantly different during transactions. However, the solutions used in the oversight part differ. zkledger employs a third-party node oversight approach, while the proposed solution uses a method without third-party node oversight. In zkledger, the third-party oversight node remains constant, existing continuously during program execution, increasing space overhead. In the proposed solution, the node permission allocation algorithm dynamically assigns oversight permissions to participants in the system, preventing trust and security issues caused by the introduction of third-party nodes. Compared to zkledger, the main time consumption is in the permission allocation and revocation process. This consumption arises because distributed systems require participants to reach consensus; consensus is reached faster when there are fewer participants and slows down slightly when there are more participants.

[0094] 4. Experimental Analysis The experiments described above demonstrate that the model proposed in this invention completes a single transaction within milliseconds, with minimal time impact from regulatory operations. In comparative experiments with zkledger, a model that also supports transaction privacy protection and regulation, the time consumed by the model in this invention is nearly identical. Furthermore, by dynamically allocating regulatory permissions, the model reduces the probability of collusion between participants and between participants and regulators. The dynamically changing regulatory nodes are less susceptible to targeted attacks, increasing the system's fault tolerance and making it more adaptable to complex network environments.

[0095] In summary, the model proposed in this invention achieves high efficiency while realizing transaction privacy protection and supervision functions, and has higher security and fault tolerance compared with previous models that introduced third-party supervision nodes.

[0096] In summary, this invention addresses the conflict between transaction privacy protection and regulation in distributed ledgers by designing a blockchain transaction privacy protection and regulation model. In the privacy protection process, a combination of homomorphic Pederson commitments and non-interactive zero-knowledge proofs is applied, protecting transaction privacy while supporting regulators' verification of transactions. Furthermore, regarding the setting of regulators in the decentralized structure, this invention employs a regulatory authority allocation and revocation algorithm to dynamically select regulators within the system, achieving regulation without introducing any other third-party nodes, thus increasing system security. Finally, experiments demonstrate the feasibility and effectiveness of the proposed model.

[0097] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A blockchain-based transaction privacy protection system, characterized in that, include: The participant node module includes N bank nodes. Each bank node generates a Schnorr signature key pair. The public key in the Schnorr signature key pair is broadcast to other bank nodes for use in verifying the identity of the bank nodes during the transaction process. The transaction building module is used to hide the transaction amount using Pedersen commitments, generate commitments, and introduce non-interactive zero-knowledge proofs. The commitments for the transaction amount and the non-interactive zero-knowledge proofs are stored as transaction information in the distributed ledger. The dynamic supervision module is used to dynamically elect a supervisory node from N bank nodes using a consensus mechanism. The supervisory node initiates a supervision request to the target node and verifies the consistency of the returned data with the distributed ledger. After the supervision task is completed, the supervisory node's supervision authority is revoked.

2. The blockchain-based transaction privacy protection system as described in claim 1, characterized in that, Using Pedersen commitments to hide the transaction amount, a commitment value is generated, including: Set up a cyclic group and two random generators and ; Randomly select blinding factor A commitment to generate a transaction amount m .

3. The blockchain-based transaction privacy protection system as described in claim 1, characterized in that, The distributed ledger uses a table structure for storage, with each row corresponding to a transaction and each column corresponding to the transaction information of a bank node. The transaction information also includes vouchers, which are calculated based on public keys and blind factors.

4. The blockchain-based transaction privacy protection system as described in claim 1, characterized in that, The introduction of non-interactive zero-knowledge proofs to verify asset scope, break-even, and transaction consistency includes: Construct a triple ,in This indicates proof of the scope of assets. This indicates proof of a balance of payments. This represents a proof of consistency. The asset amount of bank nodes is constrained by the asset scope proof; The balance sheet is used to verify the balance between the transfer in and transfer out of the transaction assets. The consistency of the blind factor in the commitment value and the blind factor in the voucher is verified through the consistency proof verification.

5. The blockchain-based transaction privacy protection system as described in claim 4, characterized in that, The asset amount of bank nodes is constrained through asset scope proof, including: Analyze the transactions of the bank nodes that initiate transactions in the distributed ledger; The asset scope proof ensures that the amount spent in the transaction does not exceed the total assets.

6. A blockchain-based method for protecting transaction privacy, characterized in that, include: A bank node creates a transaction, hides the transaction amount using a Pedersen commitment, generates a commitment, and introduces a non-interactive zero-knowledge proof. The commitment to the transaction amount and the non-interactive zero-knowledge proof are stored as transaction information in the distributed ledger. A consensus mechanism is used to dynamically elect a regulatory node from N bank nodes. The regulatory node then initiates a regulatory request to the target node and verifies the consistency of the returned data with the distributed ledger. Revoke the regulatory authority of the regulatory node after the regulatory task is completed.

7. The blockchain-based transaction privacy protection method as described in claim 6, characterized in that, A consensus mechanism is used to dynamically elect a regulatory node from N bank nodes, including: Select a bank node as the elector node and broadcast the elector node's information to other bank nodes. The elector node's information includes the vote initiation signal, the current election round, the node signature, and the tag calculated by the node using the current time. Other bank nodes verify the node signature and current election round of the elector node. If the verification is successful, they combine the current election round, their own ID and signature with the tag obtained by themselves through the current time to form a response message and broadcast it. The elector nodes verify the signature in the response message. If the verification passes, they record the mark obtained by each node at the current time and calculate an intermediate value based on the mark obtained by each node at the current time. If all other nodes' flags are received or more than a preset proportion of nodes have returned a response by the time the set response time has expired, count the frequency of the median value and select the node with the highest frequency as the selected node. The elector nodes will broadcast the election results; Other nodes verify the signatures in the election results information, and the selected node is granted supervisory authority.

8. The blockchain-based transaction privacy protection method as described in claim 7, characterized in that, The intermediate value is calculated as follows: q= in, The markers calculated by other nodes using the current time. Let q be the total number of bank nodes, and q be the median value.

9. The blockchain-based transaction privacy protection method as described in claim 6, characterized in that, The process involves the supervisory node initiating a supervisory request to the target node and verifying the consistency of the returned data with the distributed ledger, including: The supervisory node sends a supervisory request to the supervised node. The supervisory request carries the signal to perform the supervisory operation, the current supervisory round, the supervisory node's signature, and the time of the supervisory operation. Upon receiving a regulatory request, the regulated node verifies the signature of the regulatory node and the correctness of the current regulatory round in the request. If the verification is successful, the regulated node returns the data required for regulation, including the assets owned by the regulated node, the quantity of all non-zero transactions, vouchers related to the blind factor in the Pedersen commitment, and proof of the legality of the transaction funds, combined with the current regulatory round information and its own... The response information, consisting of the signature, is returned to the monitoring node. The regulatory node verifies the correctness of the signature in the response information. If the verification is correct, the regulatory node checks the returned data of the regulated node through the information recorded in the distributed ledger. If the verification is correct, the node's transaction passes the supervision; otherwise, it indicates that there is a problem with the node's funds and outputs the corresponding result.

10. The blockchain-based transaction privacy protection method as described in claim 6, characterized in that, Revoke the regulatory authority of the regulatory node after the regulatory task is completed, including: The regulatory node will broadcast a request to revoke regulatory authority. This request includes a revocation signal, the current round of revocation, the regulatory node's signature, and the time when the revocation operation was performed. After receiving the broadcast message, other nodes verify the correctness of the supervisory node signature in the broadcast and the current round of supervisory revocation. If the verification is correct, they will update the current round of supervisory revocation and their own signature. Signature and signals allowing the revocation of supervisory authority The response information is broadcast. The supervisory node verifies the correctness of the signature in the broadcast message from other nodes. If the verification is successful, it records the nodes that have responded. ; If the supervisory node receives acceptance messages from all other nodes or if more than a preset proportion of nodes have returned responses within the set response time, the supervisory node broadcasts a successful revocation message; otherwise, it outputs a revocation operation failure message. Other nodes verify the signature in the successful revocation message. If the verification is correct, they do not continue to respond to regulatory information from the regulatory nodes in the current regulatory round.

Images