Anonymous transfer method and device based on blockchain, and electronic device

Abstract

The present application discloses an anonymous transfer method and device based on blockchain, and an electronic device, the method comprising: processing the anonymous address private key of the initiator based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is less than the first bit; determining the transaction information corresponding to the transfer information based on the hash function algorithm; constructing the initiator transfer data based on the transfer information and the transaction information; constructing the receiver transfer data; generating proof of the transaction based on the initiator transfer data and the receiver transfer data, the proof being used for nodes in the blockchain to verify the transaction. The anonymous transfer method based on blockchain provided by the present application shortens the generation time of proof of anonymous transfer, reduces the amount of calculation for generating proof, increases the application scenarios of anonymous transfer, and expands the scope of use of anonymous transfer.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to an anonymous transfer method and device, and electronic equipment based on blockchain. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming to financial technology (Fintech); however, due to the security and real-time requirements of the financial industry, Fintech also puts forward higher requirements on technology. In the field of Fintech, higher requirements are also put forward for the real-time and efficiency of anonymous transfers based on blockchain. However, in the existing technology, the proof generation time for anonymous transfers is long and the calculation amount is large, which limits the application scenarios of anonymous transfers. Summary of the invention

[0003] The embodiments of the present application provide a blockchain-based anonymous transfer method and device, a computer program product, a storage medium, and an electronic device, which can shorten the generation time of proof of anonymous transfer, reduce the amount of calculation for generating proof, increase the application scenarios of anonymous transfer, and expand the scope of use of anonymous transfer.

[0004] The anonymous transfer method based on blockchain provided in the embodiment of the present application includes:

[0005] The anonymous address private key of the initiator is processed based on the hash function generation, and for the transfer information of the transaction, the factor of the hash function is less than the first bit;

[0006] Determine transaction information corresponding to the transfer information based on the hash function;

[0007] Constructing initiator transfer data based on the transfer information and the transaction information;

[0008] Construct the recipient's transfer data;

[0009] Generate evidence of the transaction based on the initiator transfer data and the recipient transfer data, and use the evidence to verify the transaction at a node in the blockchain.

[0010] In an optional implementation manner of the present application, the processing of the anonymous address private key of the initiator based on the hash function to generate transfer information for the transaction includes:

[0011] Intercept the first part of the private key of the anonymous address of the initiator;

[0012] Add a first computing domain identifier before the first part of characters and add a number 0 after the first characters to obtain a first character string;

[0013] The first character string is used as a factor of the hash function, and the calculated hash value is the public key of the anonymous address of the initiator in the transfer information; the public key of the anonymous address of the initiator corresponds to the private key of the anonymous address of the initiator.

[0014] In an optional implementation manner of the present application, the determining, based on the hash function, the transaction information corresponding to the transfer information of the initiator includes:

[0015] Intercept the second part of the private key of the anonymous address of the initiator;

[0016] Add a second computing domain identifier before the second part of characters, and add a random number rho after the second part of characters to obtain a second character string;

[0017] The hash value obtained by calculating the second character string as a factor of the hash function is used as a unique identifier in the transaction information.

[0018] In an optional implementation manner of the present application, the determining, based on the hash function, the transaction information corresponding to the transfer information of the initiator includes:

[0019] The third part of the characters of the private key of the anonymous address of the initiator is intercepted, and a random number is concatenated before the third part of the characters to obtain a first substring;

[0020] The fourth part of characters of the random number used to calculate the unique identifier of the transaction is intercepted, and the token value of the transaction is concatenated after the fourth part of characters to obtain a second substring;

[0021] Concatenate the first substring and the second substring to obtain a third string;

[0022] The hash value obtained by calculating the third character string as a factor of the hash function is the commitment in the transaction information.

[0023] In an optional implementation manner of the present application, the determining, based on the hash function, the transaction information corresponding to the transfer information of the initiator includes:

[0024] Determine the root of the Merkle tree corresponding to all commitments on the blockchain based on the hash function;

[0025] Calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree;

[0026] The validity of the commitment in the transaction information is determined based on the path.

[0027] In an optional implementation manner of the present application, the constructing of the recipient transfer data includes:

[0028] Generate a key pair for a one-time signing key;

[0029] Generate a hash value hsig based on the public key in the key pair;

[0030] Based on the hash function, a random number rho_i corresponding to the hash value hsig and used to calculate a transaction uniqueness identifier is determined.

[0031] In an optional implementation manner of the present application, rho_i=poseidon(0||i||10||[phi]_250||hsig).

[0032] In an optional implementation manner of the present application, the first bit is 256 bits.

[0033] The embodiment of the present application provides an anonymous transfer device based on blockchain, the device comprising:

[0034] A first generating unit, configured to process the anonymous address private key of the initiator based on a hash function to generate transfer information for the transaction;

[0035] a determining unit, configured to determine transaction information corresponding to the transfer information based on the hash function;

[0036] A construction unit, configured to construct initiator transfer data based on the transfer information and the transaction information; and construct receiver transfer data;

[0037] The second generating unit generates evidence of the transaction based on the initiator transfer data and the recipient transfer data, wherein the evidence is used for nodes in the blockchain to verify the transaction.

[0038] In an optional implementation manner of the present application, the first generating unit is used to intercept the first part of the characters of the private key of the anonymous address of the initiator;

[0039] The first calculation domain identifier is concatenated before the first part of characters, and the number 0 is concatenated after the first part of characters to obtain a first character string;

[0040] The first character string is used as a factor of the hash function, and the calculated hash value is the public key of the anonymous address of the initiator in the transfer information; the public key of the anonymous address of the initiator corresponds to the private key of the anonymous address of the initiator.

[0041] In an optional implementation manner of the present application, the determining unit is used to intercept the second part of the characters of the private key of the anonymous address of the initiator;

[0042] Add a second computing domain identifier before the second part of characters, and add a random number rho after the second part of characters to obtain a second character string;

[0043] A hash value obtained by calculating the second character string as a factor of the hash function is used as a unique identifier in the transaction information.

[0044] In an optional implementation manner of the present application, the determining unit is used to intercept the third part of the characters of the anonymous address private key of the initiator, and concatenate a random number before the third part of the characters of the anonymous address private key of the initiator to obtain a first substring;

[0045] The fourth part of characters of the random number used to calculate the unique identifier of the transaction is intercepted, and the token value of the transaction is concatenated after the fourth part of characters to obtain a second substring;

[0046] Concatenate the first substring and the second substring to obtain a third string;

[0047] The hash value obtained by calculating the third character string as a factor of the hash function is the commitment in the transaction information.

[0048] In an optional implementation manner of the present application, the determining unit is used to determine the root of the Merkle tree corresponding to all commitments on the blockchain based on a hash function;

[0049] Calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree;

[0050] The validity of the commitment in the transaction information is determined based on the path.

[0051] In an optional implementation of the present application, the construction unit is used to generate a key pair for a one-time signature key; generate a hash value hsig based on a public key in the key pair; and determine a random number rho_i corresponding to the hash value hsig for calculating a transaction unique identifier based on a hash function.

[0052] In an optional implementation manner of the present application, rho_i=poseidon(0||i||10||[phi]_250||hsig).

[0053] In an optional implementation manner of the present application, the first bit is 256 bits.

[0054] The computer program product provided in the embodiment of the present application includes computer executable instructions, which, after being executed, can implement the above-mentioned blockchain-based anonymous transfer method.

[0055] The storage medium provided in the embodiment of the present application stores executable instructions, and when the executable instructions are executed by the processor, the above-mentioned blockchain-based anonymous transfer method is implemented.

[0056] An electronic device provided in an embodiment of the present application includes a memory and a processor, wherein the memory stores computer executable instructions, and when the processor runs the computer executable instructions on the memory, the above-mentioned blockchain-based anonymous transfer method can be implemented.

[0057] In the anonymous transfer method based on blockchain provided in the embodiment of the present application, the anonymous address private key of the initiator is processed based on a hash function to generate transfer information for the transaction, and the factor of the hash function is less than the first bit; the transaction information corresponding to the transfer information is determined based on the hash function; the initiator transfer data is constructed based on the transfer information and the transaction information; the receiver transfer data is constructed; and the evidence of the transaction is generated based on the initiator transfer data and the receiver transfer data, and the evidence is used for the nodes in the blockchain to verify the transaction. In this way, since the factor of the hash function for generating the transfer information and the transaction information for the transaction is less than the first bit, it is possible to shorten the time required to generate the evidence for the transfer transaction, reduce the amount of calculation for generating proof, and thus improve the efficiency of the transfer transaction, increase the application scenarios of anonymous transfer, and expand the scope of use of anonymous transfer.

[0058] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of an anonymous transfer method based on blockchain provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of an optional processing flow for constructing recipient transfer data for an embodiment of the present application;

[0061] Figure 3 A schematic diagram of the structure of an anonymous transfer device based on blockchain provided in an embodiment of the present application;

[0062] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0063] Before describing the embodiments of the present application in detail, the related technologies involved in the embodiments of the present application are briefly described.

[0064] In recent years, cryptography has been used for anonymous transfers and related privacy protection. The most famous ones are Monero, which uses ring signatures, and Grin, which uses the Minble Wimble protocol. At the same time, the Zerocash paper proposed the use of non-interactive succinct zero-knowledge proof (Zksnark) to achieve anonymous transfers based on the UTXO model.

[0065] The ZCASH team improved and implemented the famous ZCASH chain based on the Groth16 zero-knowledge proof protocol on the basis of zerocash. So far, the ZCASH chain is still the public chain with the best privacy protection. With the upgrade of Ethereum's Byzantine fork, EVM and smart contracts support the pairing operation required for zero-knowledge proof calculation. The ZCASH team cooperated with Ethereum to implement the Ethereum-based zero-knowledge proof protocol babyZoE to provide anonymous transfer services for Ethereum's ERC20 token. Later, most projects used an architecture similar to babyZoE to implement anonymous transactions and other privacy protection functions of ERC20 tokens. At present, the two more mainstream anonymous transfer projects on Ethereum are ZETHER and ZETH.

[0066] ZETHER is an anonymous transaction solution based on the account model, that is, the smart contract stores the balance of each user in an encrypted manner, using the Σ-Bullets (combination of Σ-protocol and bulletproof) proof framework.

[0067] ZETH is a project proposed by the ZCASH team in 2019. It is an anonymous transaction solution based on the UTXO model. As an upgraded version of babyZoE, it is more complete and easy to use. The logic of circuit is similar to that of ZCASH, and it is the implementation of ZCASH on Ethereum. The anonymous transaction solution of the UTXO model uses the common groth16 zk-snark framework, developed with the libsnark library, and writes circuit in C++.

[0068] The anonymous transaction scheme based on the UTXO model takes a long time to generate the proof field, up to more than 10 seconds. Since the anonymous transfer scenario has high real-time requirements for transactions, the long time to generate the proof field limits the use of zero-knowledge proof in anonymous transfer scenarios.

[0069] The applicant discovered during the implementation of the anonymous transaction scheme based on the UTXO model that the main factor affecting the generation time of the proof field is the number of constraints in the zero-knowledge proof circuit. In the existing ZETH scheme, the blake2s hash function is widely used as a pseudo-random number function (PRF) in the proof circuit, which is used in the generation of commitments, the generation of nullifiers, the corresponding verification of pk and sk, the verification of signatures and sk, etc.; since the efficiency of the blake2s hash function is very low, which is equivalent to sha256, it greatly affects the magnitude of the overall constraints and the generation time of the proof field. If a transfer transaction needs to calculate 15 PRFs, then 15 hashes (Blake2s) need to be calculated.

[0070] In addition, the commitment in the anonymous transaction constitutes a 32-layer merkle tree. In the case of a transaction with two inputs and two outputs, the zero-knowledge proof circuit needs to calculate a total of 32 hash values ​​to calculate the path from the commitment to the merkle tree root. According to calculations, the number of constraints of a Blake2S hash is 21472, and the number of constraints of a mimc hash is 9856. The huge number of constraints seriously affects the time required to generate the proof field.

[0071] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0072] The following is a detailed introduction to an anonymous transfer method based on blockchain involved in an embodiment of the present application. The execution subject of the anonymous transfer method based on blockchain provided in the embodiment of the present application can be a device or equipment with data processing capabilities corresponding to the transfer initiator, which is not limited in the embodiment of the present application.

[0073] See also Figure 1 As shown, it is a flowchart of an anonymous transfer method based on blockchain provided in an embodiment of the present application, which includes the following steps:

[0074] S101. Processing the anonymous address private key of the initiator based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is smaller than the first bit.

[0075] In some embodiments, the first bit is 256 bits, and the hash function can be a Poseidon hash function. A hash function is an algorithm that maps a digital message to a string of fixed length, which is also called a message digest, a hash value, or a fingerprint. If the input digital messages are different, the probability of mapping to the same string using a hash function is extremely small and can even be ignored. It is known that the string mapped using a hash function cannot calculate the corresponding original digital message.

[0076] In some embodiments, the Poseidon hash function may be of the form:

[0077] contract Poseidon

[0078] function poseidon(uint256[]memory input)public pure returns(uint256);

[0079] }

[0080] Among them, the factor of the Poseidon hash function can be an integer multiple of 254 bits, and the size of the input parameter of the Poseidon hash function can be an integer multiple of 254 bits.

[0081] In some embodiments, if the hash function is a Poseidon hash function, the blockchain-based anonymous transfer device processes the initiator's anonymous address private key based on the Poseidon hash function to generate transfer information for the transaction.

[0082] In some embodiments, the transfer information may include: the anonymous address public key of the initiator, represented by a_pk. The process of generating a_pk based on the poseidon hash function may be: intercepting the first part of the characters of the anonymous address private key of the initiator corresponding to the anonymous address public key of the initiator, and splicing the first calculation domain identifier in front of the first part of the characters, splicing the number 0 after the first part of the characters to obtain a first string, using the first string as a factor of the poseidon hash function, and the poseidon hash value calculated is a_pk. The number 0 is spliced ​​after the intercepted number to ensure that the bit position of the first string is 254 bits.

[0083] In some embodiments, the public key of the anonymous address of the initiator is the public parameter, which is the publicly available part of the proof information provided by the prover to the verifier in the zero-knowledge proof.

[0084] In some embodiments, the private key of the anonymous address of the initiator is the secret parameter, which is the secret information held by the prover in the zero-knowledge proof. The prover wants to let the verifier know that he has the secret information, but does not reveal the secret information to the verifier.

[0085] In specific implementation, the length of the first part of the initiator's anonymous address private key corresponding to the anonymous address public key of the initiator can be flexibly set, such as 250 bits, to ensure that the input of the poseidon hash function is 254 bits; the first calculation domain identifier can be binary data of a set length, such as 0010, to ensure that the input factor is within the calculation domain of the poseidon hash function. Taking the calculation domain identifier as 0010 and the length of the first part of the characters as 250 bits as an example, the process can be described as: a_pk = poseidon (0010||[a_sk]_250||0), a_sk is the initiator's anonymous address private key, a_pk is the initiator's anonymous address public key, and 0010||[a_sk]_250||0 is the first character string.

[0086] S102: Determine transaction information corresponding to the transfer information based on the hash function.

[0087] In some embodiments, the blockchain-based anonymous transfer device determines transaction information corresponding to the transfer information based on the poseidon hash function.

[0088] In some embodiments, the transaction information may include at least one of the following: a unique identifier of the transaction, represented by nf; a commitment of the transaction; and the validity of the commitment, represented by mkpath.

[0089] In some embodiments, the transaction information may also include a transfer note of the initiator of the transaction (inputnote) and a transfer note of the recipient of the transaction (outputnote); wherein inputnote may include a_pk described in step S101, and may also include value, where value is the amount of the transaction; therefore, it may be expressed as inputnote(a_pk, value). Outputnote may include a_pk described in step S101, as well as value, rho and trap_r; wherein value is the amount of the transaction, and rho may be a random number generated by an anonymous transfer device based on blockchain, as the unique identifier of this transaction, if this transaction is successful or this transaction is consumed, the rho corresponding to this transaction will be placed in the nullifier table. If the transaction is consumed again, a double-spending error will be triggered, and a double-spending protection mechanism for the transaction will be activated. trap_r may be a random number generated by an anonymous transfer device based on blockchain. Therefore, it may be expressed as outputnote(a_pk, value, rho, trap_r).

[0090] In specific implementation, the process of determining the unique identifier (nullifier) ​​of a transaction based on the poseidon hash function may be: intercepting the second part of the characters of the private key of the anonymous address of the initiator corresponding to the public key of the anonymous address of the initiator, and splicing the second computing domain identifier in front of the second part of the characters, splicing rho after the second part of the characters to obtain a second string, using the second string as a factor of the poseidon hash function, and the calculated poseidon hash value is the nullifier, represented by nf. Among them, the second computing domain identifier can be binary data of a set length, such as 1010, to ensure that the input factor is within the computing domain of poseidon; the length of the second part of the characters can be flexibly set, such as 250 bits, to ensure that the input of the poseidon hash function is 254 bits. Taking the computing domain identifier as 1010 and the length of the second part of the characters as 250 bits as an example, the process can be described as: nf = poseidon (1010||[a_sk]_250||rho), 1010||[a_sk]_250||rho is the second string.

[0091] In specific implementation, the process of determining the commitment in the transaction information based on the poseidon hash function is the process of determining the unspent ciphertext corresponding to inputnout, which may be: intercepting the third part of the private key of the anonymous address of the initiator, and splicing a random number before the third part of the characters to obtain a first substring; intercepting the fourth part of the random number used to calculate the unique identifier of the transaction, and splicing the token value of the transaction after the fourth part of the characters to obtain a second substring; splicing the first substring and the second substring to obtain a third string; using the third string as a factor of the poseidon hash function to calculate the poseidon hash value obtained as the commitment in the transaction information. Among them, the length of the third part of the characters and the fourth part of the characters can be equal or different; the length of the third part of the characters and the fourth part of the characters can be flexibly set, such as 94 bits, to ensure that the input of the poseidon hash function is 254 bits.

[0092] For example, the random number used to calculate the unique identifier (nf) of a transaction is rho; the token value of the transaction is v, the random number is represented by trap_r, which can be a 32-bit random number, the anonymous address private key of the initiator is represented by a_pk, and the commitment is represented by inner_k, then

[0093] inner_k=poseidon(trap_r||a_pk

[94] ||[rho]_94||v), trap_r||[a_pk]_94 is the first substring, [rho]_94||v is the second substring, and trap_r||[a_pk]_94||[rho]_94||v is the third substring.

[0094] In specific implementation, the process of determining the validity of the commitment in the transaction information based on the poseidon hash function can be: determining the root of the Merkle tree corresponding to all commitments on the blockchain based on the poseidon hash function; calculating the path from the commitment corresponding to the transaction to the root of the Merkle tree; determining the validity of the commitment in the transaction information based on the path. Among them, the Merkle tree is a binary tree, and the hash of the leaves and leaves generates the root; the Merkle tree can be used to determine whether a certain commitment exists. That is, all commitments on the blockchain are taken as leaf nodes of the Merkle tree, and the root of the Merkle tree is calculated. Only the root of the Merkle tree is stored on the blockchain. If it is necessary to prove whether a commitment exists (that is, before the transferor needs to spend the private asset, it must be determined whether the asset exists in the system), it is necessary to provide the path from the commitment to the root of the Merkle tree. If the path meets the requirements, the corresponding root can be obtained after the leaves and leaves are calculated, and the root exists on the blockchain, then it can be determined that the commitment exists.

[0095] For example, all commitments on the blockchain are taken as leaf nodes of the Merkle tree, the root of the Merkle tree is determined based on the poseidon hash function, and the path (mkpath) from the commitment corresponding to the transaction to the root of the Merkle tree is calculated to determine whether the commitment exists. If mkpath meets the requirements, it can be determined that the commitment exists and the transaction can be carried out; if mkpath does not meet the requirements, it can be determined that the commitment does not exist and the transaction cannot be carried out. mkpath represents the path from the commitment to the root of the Merkle tree, then mkpath = Poseidon (left, right); where left and right represent the roots of two Merkle trees respectively.

[0096] It should be noted that a_pk, random number rho, commitment (CM) and nullifier in the embodiment of the present application are some variables in anonymous transfer (note). Anonymous transfer is a transaction that occurs on the blockchain, and both the initiator and the receiver of the transaction are anonymous. Among them, a_pk represents the public key of the holder, also known as the payee address; the transaction amount is represented by b, which represents the token value of the note; the random number rho is the unique identifier of each note. When a note is consumed, rho will be placed in the nullifier table, indicating that the note has been consumed; when the same note is consumed again, a double-spending error will be triggered, that is, the transaction double-spending protection mechanism. Commitment (CM) is the hash value of the note, which is the input of the anonymous transfer. Nullifier represents the invalid note, which is generated based on the random number rho in the consumed note and the hash value generated by the user's private key.

[0097] S103, constructing the initiator transfer data based on the transfer information and the transaction information;

[0098] In some embodiments, the blockchain-based anonymous transfer device constructs the initiator transfer data based on the transfer information and the transaction information.

[0099] In some embodiments, the structure of the initiator transfer data may be: JoinsplitInput(mkpath, input_note, a_sk, input_nullifier). Wherein, mkpath is the mkpath in the transaction information described in step S102, a_sk is the private key of the anonymous address of the initiator in the transfer information; input_note is the same as the inputnote in the transaction information described in step S102, and input_nullifier is the same as the nf in the transaction information described in step S102.

[0100] S104: Construct recipient transfer data.

[0101] In some embodiments, a blockchain-based anonymous transfer device constructs recipient transfer data.

[0102] In some embodiments, an optional processing flow diagram for constructing the recipient transfer data may be as follows: Figure 2 As shown:

[0103] Step a: Generate a one-time signature key pair.

[0104] In some embodiments, the key pair of the one-time signing key is represented by signing_keypair, signing_keypair=signing.gen_signing_keypair(). The key pair of the one-time signing key is used to construct the hsig signature and generate the joinsplit signature.

[0105] Step b: Generate a hash value hsig based on the public key in the key pair.

[0106] In some embodiments, the key pair of the one-time signature key includes a public key of the one-time signature key and a private key of the one-time signature key; in an embodiment of the present application, a hash calculation is performed on the public key in the key pair of the one-time signature key based on a hash function to generate a corresponding hash value hsig.

[0107] In specific implementation, the sha256 algorithm can be used to calculate the public key in the key pair of the one-time signature key to obtain the corresponding hash value hsig; as shown in the following formula:

[0108] h_sig=sha256(nf0||nf1||sign_vk);

[0109] Among them, nf0 and nf1 may be the values ​​obtained by calculating nf in step S102.

[0110] The rho in outputnote(a_pk, value, rho, trap_r) described in step S102 can be determined based on the poseidon hash function; the process of determining the rho in outputnote based on the poseidon hash function can be expressed as:

[0111] rho=poseidon(0||i||10||[phi]_250||hsig);

[0112] Among them, i is related to the number of inputs and outputs. Taking a two-input transaction as an example, i is 0 and 1. Phi can be a 32-bit random number, and [phi]_250 is the first 250 bits of the 32-bit random number Phi.

[0113] Step c: determining the random number rho_i corresponding to the hash value hsig and used to calculate the transaction uniqueness identifier based on the poseidon hash function.

[0114] For trap_r in outputnote(a_pk, value, rho, trap_r) described in step S102, it can be a 32-bit random number generated by an anonymous transfer device based on blockchain.

[0115] At this point, the structure of the receiver's transfer data, JoinsplitOutput (output_note), has been constructed.

[0116] Step S105, generating evidence of the transaction based on the initiator transfer data and the recipient transfer data, wherein the evidence is used for nodes in the blockchain to verify the transaction.

[0117] In some embodiments, the anonymous transfer device based on blockchain generates evidence (proof field) of the transaction based on the initiator's transfer data and the receiver's transfer data; the proof field is a field obtained by the prover using ProveKey to transform the secret parameter in the zero-knowledge proof, and the proof field is used by the verifier to verify the correctness of the proof field. In conjunction with the embodiments of the present application, the proof field can be generated by the initiator of the transaction and sent to the nodes in the blockchain, and the nodes in the blockchain verify the correctness of the proof field; the transaction is executed when the nodes in the blockchain verify that the proof field is correct.

[0118] Among them, zero-knowledge proof is a cryptographic proof idea. The prover and the verifier jointly agree on a rule. In the rule, the prover provides a string of ciphertext to the verifier without exposing his own private evidence. By verifying the ciphertext, the verifier can believe that the prover has the corresponding private evidence, but the verifier cannot know the content of the private evidence. The Proof field is a zero-knowledge proof. The prover does not want to expose the secret parameters he holds, but needs to make the verifier believe that he has the secret parameters. Therefore, the prover uses ProveKey to convert the secret parameters into the proof field and send it to the verifier. The verifier can verify the correctness of the proof field and believe that the prover knows the secret parameters, but the verifier cannot infer the prover's secret parameters through the proof field.

[0119] The proof field can be expressed as: ProofInput(merkle_roots,js_inputs,js_outputs,h_sig,phi). Among them, js_inputs is the initiator's transfer data (Joinsplitinput), js_outputs is the receiver's transfer data (JoinsplitOutput); phi and h_sig are obtained in step S104. The root of the Merkle tree (merkle_roots) is obtained in step S102.

[0120] In the embodiment of the present application, the process of generating the proof field of a transaction can be called Prove; that is, in zero-knowledge proof, the prover uses the ProveKey to construct the proof field according to its own public parameters and secret parameters. The key required by the prover to generate the proof field. The ProveKey must correspond to the VerifyKey required by the verifier to verify the proof field.

[0121] The process of the prover generating the proof field and the verifier verifying the proof field can be a rule jointly agreed upon by the prover and the verifier; and the implementation of the rule jointly agreed upon by the prover and the verifier in the specific algorithm can adopt a zero-knowledge proof circuit, which describes the mapping relationship between public parameters and secret parameters. Before performing zero-knowledge proof, the verifier and the prover negotiate the mapping relationship between public parameters and secret parameters; when the prover provides evidence, it provides the proof field after the public parameters and secret parameters are converted. When verifying, the verifier verifies whether the proof field and the public parameters satisfy the previously agreed mapping relationship. If the mapping relationship is satisfied, the verifier can be sure that the prover has the corresponding secret parameters. This mapping relationship is the zero-knowledge proof circuit.

[0122] In the embodiment of the present application, the anonymous transfer method based on blockchain can be implemented based on a zero-knowledge proof circuit. Specifically, the DAP model can be used to implement anonymous transfers based on blockchain. The DAP model includes a zero-knowledge proof circuit for private transfers. The nodes on the blockchain negotiate and determine the rules for private transfers, that is, the zero-knowledge proof circuit for private transfers in the DAP model; the private transferor constructs a private transaction based on the DAP model, and sends the public parameters and proof fields in the transaction to the blockchain. The nodes on the blockchain confirm whether the private transaction is legal by verifying the mapping relationship between the public parameters and the proof field. If the verification is successful, the private transaction occurs.

[0123] In the embodiment of the present application, since the factor of the hash function used in the process of generating the proof field of the transaction is less than 256 bits, compared with the Blakes2s hash function and Mimc hash function with a maximum input of 256 bits used in the existing anonymous transfer method, the number of constraints in the zero-knowledge proof circuit can be greatly reduced. For example, the number of constraints in the zero-knowledge proof circuit using the Blakes2s hash function is 21472, the number of constraints in the zero-knowledge proof circuit using the Mimc hash function is 9856, and the number of constraints in the zero-knowledge proof circuit using the poseidon hash function is 3736; it can be seen that the number of constraints in the zero-knowledge proof circuit using the poseidon hash function is about one-fifth of that using the Blakes2s hash function, and about one-third of that using the Mimc hash function. In this way, the amount of data calculation can be reduced, the generation time of the proof field can be accelerated, and the efficiency of the transfer transaction can be improved, the application scenarios of anonymous transfers can be increased, and the scope of use of anonymous transfers can be expanded.

[0124] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0125] In order to implement the above-mentioned anonymous transfer method based on blockchain provided in the embodiment of the present application, the embodiment of the present application also provides an anonymous transfer device based on blockchain, Figure 3 A schematic diagram of the structure of an anonymous transfer device 200 based on blockchain provided in an embodiment of the present application, wherein the device comprises:

[0126] A first generating unit 201 is used to process the anonymous address private key of the initiator based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is less than the first bit;

[0127] A determining unit 202, configured to determine transaction information corresponding to the transfer information based on the hash function;

[0128] A construction unit 203 is used to construct the initiator's transfer data based on the transfer information and the transaction information; and construct the receiver's transfer data;

[0129] The second generating unit 204 generates evidence of the transaction based on the initiator transfer data and the recipient transfer data, wherein the evidence is used for nodes in the blockchain to verify the transaction.

[0130] In an optional implementation manner of the present application, the first generating unit 201 is used to intercept the first part of the characters of the private key of the anonymous address of the initiator;

[0131] The first calculation domain identifier is concatenated before the first part of characters, and the number 0 is concatenated after the first part of characters to obtain a first character string;

[0132] The first character string is used as a factor of the hash function, and the calculated hash value is the public key of the anonymous address of the initiator in the transfer information; the public key of the anonymous address of the initiator corresponds to the private key of the anonymous address of the initiator.

[0133] In an optional implementation manner of the present application, the determining unit 202 is used to intercept the second part of the characters of the private key of the anonymous address of the initiator;

[0134] Add a second computing domain identifier before the second part of characters, and add a random number rho after the second part of characters to obtain a second character string;

[0135] A hash value obtained by calculating the second character string as a factor of the hash function is used as a unique identifier in the transaction information.

[0136] In an optional implementation manner of the present application, the determining unit 202 is used to intercept the first 94 bits of the initiator's anonymous address private key, and concatenate a random number before the third part of the characters of the initiator's anonymous address private key to obtain a first substring;

[0137] The fourth part of characters of the random number used to calculate the unique identifier of the transaction is intercepted, and the token value of the transaction is concatenated after the fourth part of characters to obtain a second substring;

[0138] Concatenate the first substring and the second substring to obtain a third string;

[0139] The hash value obtained by calculating the third character string as a factor of the hash function is the commitment in the transaction information.

[0140] In an optional implementation manner of the present application, the determining unit 202 is used to determine the root of the Merkle tree corresponding to all commitments on the blockchain based on a hash function;

[0141] Calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree;

[0142] The validity of the commitment in the transaction information is determined based on the path.

[0143] In an optional implementation of the present application, the construction unit 203 is used to generate a key pair for a one-time signature key; generate a hash value hsig based on a public key in the key pair; and determine a random number rho_i corresponding to the hash value hsig for calculating a transaction unique identifier based on a hash function.

[0144] In an optional implementation manner of the present application, rho_i=poseidon(0||i||10||[phi]_250||hsig).

[0145] In an optional implementation manner of the present application, the first bit is 256 bits.

[0146] In an optional implementation manner of the present application, the hash function is a poseidon function.

[0147] Those skilled in the art should understand that Figure 3 The implementation functions of each unit in the blockchain-based anonymous transfer device shown can be understood by referring to the relevant description of the aforementioned anonymous transfer method. Figure 3 The functions of each unit in the blockchain-based anonymous transfer device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0148] The above-mentioned anonymous transfer device based on blockchain in the embodiment of the present application can also be stored in a computer-readable storage medium if it is implemented in the form of a software function module and sold or used as an independent product. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, Read Only Memory), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0149] Accordingly, an embodiment of the present application also provides a computer program product, which stores computer executable instructions, and when the computer executable instructions are executed, the above-mentioned blockchain-based anonymous transfer method of the embodiment of the present application can be implemented.

[0150] Correspondingly, an embodiment of the present application also provides a storage medium, on which executable instructions are stored, and the executable instructions are executed by a processor to process the initiator's anonymous address private key based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is less than the first bit; determine the transaction information corresponding to the transfer information based on the hash function; construct the initiator's transfer data based on the transfer information and the transaction information; construct the recipient's transfer data; generate evidence of the transaction based on the initiator's transfer data and the recipient's transfer data, and the evidence is used for the node in the blockchain to verify the transaction step.

[0151] In an optional implementation manner of the present application, the executable instructions are executed by the processor to intercept the first part of the characters of the private key of the anonymous address of the initiator; splice the first computing domain identifier in front of the first part of the characters, and splice the number 0 after the first part of the characters to obtain a first character string; use the first character string as a factor of the hash function, and calculate the hash value as the public key of the anonymous address of the initiator in the transfer information.

[0152] In an optional implementation of the present application, the executable instructions are executed by the processor to intercept the second part of the characters of the private key of the anonymous address of the initiator; concatenate a second computing domain identifier in front of the second part of the characters, and concatenate a random number rho after the second part of the characters to obtain a second character string; and use the second character string as a factor of the hash function to calculate the hash value obtained as a unique identifier in the transaction information.

[0153] In an optional implementation of the present application, the executable instructions are executed by the processor to intercept the third part of the characters of the initiator's anonymous address private key, and concatenate a random number before the third part of the characters of the initiator's anonymous address private key to obtain a first substring; intercept the fourth part of the characters of the random number used to calculate the unique identifier of the transaction, and concatenate the token value of the transaction after the fourth part of the characters to obtain a second substring; concatenate the first substring and the second substring to obtain a third string; and use the third string as a factor of the hash function to calculate a hash value as the commitment in the transaction information.

[0154] In an optional embodiment of the present application, the executable instructions are executed by the processor to determine the root of the Merkle tree corresponding to all commitments on the blockchain based on a hash function; calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree; and determine the validity of the commitment in the transaction information based on the path.

[0155] In an optional implementation of the present application, the executable instructions are executed by a processor to generate a key pair for a one-time signature key; generate a hash value hsig based on a public key in the key pair; and determine a random number rho_i corresponding to the hash value hsig for calculating a unique transaction identifier based on a hash function.

[0156] In an optional implementation manner of the present application, the first bit is 256 bits.

[0157] In order to implement the above anonymous transfer method provided in the embodiment of the present application, the embodiment of the present application also provides an electronic device, Figure 4 Schematic diagram of the structure of the electronic device according to the embodiment of the present application. Figure 4 As shown, the electronic device 50 may include one or more (only one is shown in the figure) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor (MCU, MicroController Unit) or a programmable logic device (FPGA, Field Programmable Gate Array)), a memory 504 for storing data, and a transmission device 506 for communication functions. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown.

[0158] The memory 504 can be used to store software programs and modules of application software, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, implementing the above method. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 504 may further include a memory remotely arranged relative to the processor 502, and these remote memories may be connected to the electronic device 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0159] The transmission device 506 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 50. In one example, the transmission device 506 includes a network adapter (NIC, Network Interface Controller), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 506 can be a radio frequency (RF, Radio Frequency) module, which is used to communicate with the Internet wirelessly.

[0160] The technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0161] In the several embodiments provided in the present application, it should be understood that the disclosed methods and intelligent devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0162] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0163] In addition, all functional units in the embodiments of the present application may be integrated into a second processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0164] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An anonymous transfer method based on blockchain, characterized in that: The method comprises: The anonymous address private key of the initiator is processed based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is less than the first bit; wherein the transfer information includes the anonymous address public key of the initiator, and the generation method of the anonymous address public key of the initiator includes: intercepting the first part of characters of the anonymous address private key of the initiator; splicing a first calculation domain identifier in front of the first part of characters, and splicing a number 0 after the first part of characters to obtain a first character string; using the first character string as a factor of the hash function, and calculating the hash value as the anonymous address public key of the initiator in the transfer information; the anonymous address public key of the initiator corresponds to the anonymous address private key of the initiator; Determining transaction information corresponding to the transfer information based on the hash function; the transaction information includes at least one of the following: a unique identifier of the transaction, a commitment of the transaction, and the validity of the commitment; Constructing the initiator's transfer data based on the transfer information and the transaction information; the transfer data includes: the path from the transaction commitment to the root of the Merkle tree, the initiator's transfer note, the initiator's anonymous address private key and the unique identifier of the transaction; Construct the recipient's transfer data; Generate evidence of the transaction based on the initiator transfer data and the recipient transfer data, and use the evidence to verify the transaction at a node in the blockchain.

2. The method according to claim 1, characterized in that The determining, based on the hash function, the transaction information corresponding to the transfer information comprises: Intercept the second part of the private key of the anonymous address of the initiator; Add a second computing domain identifier before the second part of characters, and add a random number rho after the second part of characters to obtain a second character string; A hash value obtained by calculating the second character string as a factor of the hash function is used as a unique identifier in the transaction information.

3. The method according to claim 1, characterized in that The determining, based on the hash function, the transaction information corresponding to the transfer information comprises: The third part of the characters of the private key of the anonymous address of the initiator is intercepted, and a random number is concatenated before the third part of the characters to obtain a first substring; The fourth part of characters of the random number used to calculate the unique identifier of the transaction is intercepted, and the token value of the transaction is concatenated after the fourth part of characters to obtain a second substring; Concatenate the first substring and the second substring to obtain a third string; The hash value obtained by calculating the third character string as a factor of the hash function is the commitment in the transaction information.

4. The method according to claim 1, characterized in that The determining, based on the hash function, the transaction information corresponding to the transfer information comprises: Determine the root of the Merkle tree corresponding to all commitments on the blockchain based on the hash function; Calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree; The validity of the commitment in the transaction information is determined based on the path.

5. The method according to claim 1, characterized in that The constructing of the recipient transfer data includes: Generate a key pair for a one-time signing key; Generate a hash value hsig based on the public key in the key pair; Based on the hash function, a random number rho_i corresponding to the hash value hsig and used to calculate a transaction uniqueness identifier is determined.

6. The method according to claim 5, characterized in that rho_i=poseidon(0||i||10||[phi]_250||hsig).

7. The method according to any one of claims 1 to 6, characterized in that: The first bit is 256 bits.

8. An anonymous transfer device based on blockchain, characterized in that: The device comprises: A first generating unit is used to process the anonymous address private key of the initiator based on a hash function to generate transfer information for the transaction, wherein the factor of the hash function is less than the first bit; wherein the transfer information includes the anonymous address public key of the initiator, and the first generating unit is specifically used to: intercept the first part of characters of the anonymous address private key of the initiator; splice the first computing domain identifier in front of the first part of characters, and splice the number 0 after the first part of characters to obtain a first character string; use the first character string as the factor of the hash function, and calculate the hash value as the anonymous address public key of the initiator in the transfer information; the anonymous address public key of the initiator corresponds to the anonymous address private key of the initiator; A determination unit, configured to determine transaction information corresponding to the transfer information based on the hash function; the transaction information includes at least one of the following: a unique identifier of the transaction, a commitment of the transaction, and the validity of the commitment; A construction unit, configured to construct the initiator's transfer data based on the transfer information and the transaction information; the transfer data includes: a path from the transaction commitment to the root of the Merkle tree, the initiator's transfer note, the initiator's anonymous address private key and the unique identifier of the transaction; and construct the receiver's transfer data; The second generating unit generates evidence of the transaction based on the initiator transfer data and the recipient transfer data, wherein the evidence is used for nodes in the blockchain to verify the transaction.

9. The device according to claim 8, characterized in that The determining unit is used to intercept the second part of the characters of the private key of the anonymous address of the initiator; Add a second computing domain identifier before the second part of characters, and add a random number rho after the second part of characters to obtain a second character string; The hash value obtained by calculating the second character string as a factor of the hash function is used as a unique identifier in the transaction information.

10. The device according to claim 8, characterized in that The determining unit is used to intercept the third part of the characters of the anonymous address private key of the initiator, and concatenate a random number before the third part of the characters of the anonymous address private key of the initiator to obtain a first substring; The fourth part of characters of the random number used to calculate the unique identifier of the transaction is intercepted, and the token value of the transaction is concatenated after the fourth part of characters to obtain a second substring; Concatenate the first substring and the second substring to obtain a third string; The hash value obtained by calculating the third character string as a factor of the hash function is the commitment in the transaction information.

11. The device according to claim 8, characterized in that The determining unit is used to determine the roots of the Merkle trees corresponding to all commitments on the blockchain based on the hash function; Calculate the path from the commitment corresponding to the transaction to the root of the Merkle tree; The validity of the commitment in the transaction information is determined based on the path.

12. The device according to claim 8, characterized in that The construction unit is used to generate a key pair of a one-time signature key; generate a hash value hsig based on a public key in the key pair; and determine a random number rho_i corresponding to the hash value hsig and used to calculate a transaction uniqueness identifier based on the hash function.

13. The device according to claim 12, characterized in that rho_i=poseidon(0||i||10||[phi]_250||hsig).

14. The device according to any one of claims 8 to 13, characterized in that The first bit is 256 bits.

15. A storage medium, characterized in that: The storage medium stores executable instructions, which, when executed by a processor, implement the method steps described in any one of claims 1 to 7.

16. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory stores computer executable instructions, and the processor can implement the method steps described in any one of claims 1 to 7 when executing the computer executable instructions on the memory.

17. A computer program product, characterized in that The computer program product comprises computer executable instructions, which, after being executed, can implement the method steps described in any one of claims 1 to 7.

Images