A method and device for generating and verifying secret commitment based on blockchain

Abstract

The embodiment of the present invention provides a method and device for generating and verifying a secret commitment based on a blockchain, the method comprising: when a secret verification node detects a verification request for any secret commitment, obtaining a secret commitment from a blockchain, generating first verification information based on the third commitment shard in the secret commitment, generating second verification information based on the first commitment shard, the second commitment shard and the first hash value in the secret commitment, comparing the first verification information with the second verification information to determine whether the secret commitment is successfully verified. In this way, when verifying the secret commitment of a secret holding node, the scheme can directly obtain the secret commitment from the blockchain for self-verification regardless of whether the secret holding node is online, and there is no need to interact with the secret holding node for random numbers before obtaining the secret commitment, thereby effectively reducing the time consumed by interacting with random numbers, thereby effectively improving the verification efficiency of the secret commitment.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of financial technology (Fintech), and in particular to a method and device for generating and verifying secret commitments based on blockchain. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. Traditional finance is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. In many business scenarios in the financial field (such as loan business scenarios or mortgage business scenarios, etc.), it is usually necessary to verify some sensitive information of users (such as lenders or mortgagers, etc.) (such as identity information, such as face images, ID card information, etc., or deposit amount information, house property information, etc.), so as to provide users with corresponding services based on these sensitive information.

[0003] At present, in an existing verification method, face recognition is used to authenticate the identity of the user. For example, when the user (i.e., the holder of sensitive information) registers, the user's face information needs to be collected. When the user logs in or pays later, the user submits the face information by face scanning. The system will verify the face information collected before and the face information submitted for this operation. If the verification is consistent, the subsequent operation can be performed. If the verification is inconsistent, the subsequent operation cannot be performed. Although this method can better authenticate the identity of the user to a certain extent, since face information is sensitive information, it will cause face information leakage or may cause face information abuse. In order to solve this problem, in another existing verification method, without leaking the user's sensitive information, the verification of the user's sensitive information is completed through the verifiable commitment of sensitive information provided by the user. Specifically, the user (i.e., the holder of sensitive information) generates a verifiable commitment based on the sensitive information plaintext without leaking the sensitive information, and uploads the verifiable commitment to the blockchain. When the verifier needs to verify the sensitive information of the user, it will send a random number to the user as a challenge value. The user calculates the verifiable information for the sensitive information based on the random number and sends the verifiable information to the verifier. The verifier obtains the verifiable commitment uploaded by the user from the blockchain, and completes the verification of the sensitive information of the user through the verifiable information and the verifiable commitment. However, this verification method for the user's sensitive information requires the user and the verifier to be online at the same time to be successfully completed. Moreover, this verification method requires the interaction of random numbers, which will increase the network overhead of the verification method and take a long time to complete the verification of the user's sensitive information, which will result in low efficiency of the verification method. At the same time, since this verification method is to transmit random numbers in the network, there is a risk that the random number will be stolen or tampered with by an attacker, resulting in low security of the verification method.

[0004] In summary, there is an urgent need for a secret commitment generation and verification method based on blockchain to effectively improve the verification efficiency of secret commitments. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for generating and verifying secret commitments based on blockchain, so as to effectively improve the verification efficiency of secret commitments.

[0006] In a first aspect, an embodiment of the present invention provides a secret commitment verification method based on blockchain, comprising:

[0007] When a secret verification node detects a verification request for any secret commitment, it obtains the secret commitment from the blockchain; the secret commitment is generated by the corresponding secret holding node based on the secret it owns and uploaded to the blockchain;

[0008] The secret verification node generates first verification information based on the third commitment slice in the secret commitment, and generates second verification information based on the first commitment slice, the second commitment slice and the first hash value in the secret commitment;

[0009] The secret verification node compares the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

[0010] In the above technical scheme, when the secret verification node needs to verify a secret commitment, the technical scheme of the present invention does not need to send a challenge (i.e., a random number generated and sent to the secret holding node corresponding to the secret commitment) to the secret holding node corresponding to the secret commitment. Instead, the secret commitment can be directly obtained from the blockchain for self-verification, so there is no need to rely on whether the secret holding node is online. In other words, whether the secret holding node is online or not, the secret verification node can verify the secret commitment, which can effectively improve the verification efficiency of the secret commitment. Specifically, when the secret verification node detects a verification request for any secret commitment, it can directly obtain the secret commitment from the blockchain without sending a challenge to the secret holding node before obtaining the secret commitment, and without the secret holding node being online, and parses the secret commitment to obtain the first commitment fragment, the second commitment fragment, the third commitment fragment and the first hash value in the secret commitment, so that the secret commitment can be verified based on the third commitment fragment. The first verification information is generated based on the first commitment slice, the second commitment slice and the first hash value. Then, the first verification information is compared with the second verification information to determine whether the secret commitment is successfully verified. In this way, when verifying the secret commitment generated by the secret holding node, the scheme can directly obtain the secret commitment from the blockchain regardless of whether the secret holding node is online, and there is no need to send a challenge to the secret holding node before obtaining the secret commitment (that is, the secret verification node generates a random number and sends it to the secret holding node corresponding to the secret commitment, so that the secret holding node can assist the secret verification node to complete the verification of the secret commitment). In this way, the time spent on interacting with the challenge can be effectively reduced, thereby effectively improving the verification efficiency of the secret commitment and improving the user experience. In addition, since the scheme does not interact with the random number in the process of verifying the secret commitment, it can effectively reduce the network overhead and prevent the attacker from stealing or tampering with the random number, thereby effectively improving the security of verifying the secret commitment.

[0011] Optionally, the generating first verification information based on the third commitment fragment in the secret commitment includes:

[0012] The secret verification node generates the first verification information by using a discrete logarithm algorithm for the third commitment shard and the generator in the finite field;

[0013] The generating second verification information based on the first commitment fragment, the second commitment fragment, and the first hash value in the secret commitment includes:

[0014] The secret verification node generates the second verification information by using the discrete logarithm algorithm with the first commitment shard, the second commitment shard, the first hash value and the first large prime number.

[0015] In the above technical solution, in order not to disclose the real secret owned by the secret holding node, the secret holding node will not upload the real secret it owns to the blockchain, but will perform obfuscation processing on the secret, generate a verifiable commitment (i.e., secret commitment) and upload it to the blockchain. Then the secret verification node verifies the authenticity of the secret commitment provided by the secret holding node, thereby determining whether the secret holding node corresponding to the secret commitment really owns the secret (i.e., whether it is the legal owner of the secret). For example, for a user's deposit information in a bank, the bank acts as a secret holding node to generate a secret commitment corresponding to the user's deposit information, or for a user's house property information, the house property management department acts as a secret holding node to generate a secret commitment corresponding to the user's house property information. Of course, for other sensitive information of the user, the user can also act as a secret holding node to generate a secret commitment corresponding to the corresponding sensitive information, and the embodiment of the present invention does not limit this. Therefore, when the secret verification node needs to verify a secret commitment provided by a secret holding node, it only needs to obtain the secret commitment directly from the blockchain, and generate the first verification information through the discrete logarithm algorithm based on the generator in the finite field (that is, when using the discrete logarithm algorithm, a generator is determined in advance from the finite field to facilitate subsequent related operations of the discrete logarithm algorithm) and the third commitment fragment in the secret commitment. In addition, the first commitment fragment, the second commitment fragment, the first hash value and the first largest prime number can be used to generate the second verification information through the discrete logarithm algorithm. Then, the verification of the secret commitment can be completed through the first verification information and the second verification information, thereby determining whether the secret commitment is true and correct.

[0016] Optionally, before determining whether the secret commitment is successfully verified, the method further includes:

[0017] The secret verification node performs a hash operation on the first commitment slice and the second commitment slice to determine a second hash value;

[0018] The secret verification node determines whether the first hash value is the same as the second hash value.

[0019] In the above technical solution, since the secret holding node may tamper with the first hash value in the secret commitment when uploading the secret commitment to the chain, thereby attempting to make the verification of the first verification information and the second verification information successful by tampering with the first hash value, therefore, in order to further verify the authenticity and correctness of the secret commitment, it is necessary to further verify the first hash value in the secret commitment, that is, to determine whether the first hash value has been tampered with by verifying the correctness of the first hash value, thereby determining whether the secret commitment is truly authentic and reliable. Specifically, by performing a hash operation on the first commitment fragment and the second commitment fragment in the secret commitment to determine the second hash value, the first hash value is compared with the second hash value to determine whether the first hash value is the same as the second hash value, thereby further accurately determining whether the secret commitment is authentic and reliable.

[0020] Optionally, comparing the first verification information with the second verification information to determine whether the secret commitment is successfully verified includes:

[0021] The secret verification node determines whether the first verification information is the same as the second verification information;

[0022] If the secret verification node determines that the first verification information is the same as the second verification information, then when it is determined that the first hash value is the same as the second hash value, it is determined that the secret commitment verification is successful.

[0023] In the above technical solution, since the secret holding node may tamper with the first hash value in the secret commitment when uploading the secret commitment to the chain, in order to further verify the secret commitment to determine whether the secret commitment is authentic and reliable, after determining that the first verification information is the same as the second verification information, it is also necessary to verify the first hash value in the secret commitment. Only after the first hash value is also successfully verified (that is, the first hash value is the same as the second hash value), can it be determined that the secret commitment verification is successful, thereby determining that the secret commitment is authentic and reliable.

[0024] In a second aspect, an embodiment of the present invention provides a method for generating a secret commitment based on blockchain, comprising:

[0025] When receiving the secret commitment generation request, the secret holding node generates a first commitment shard based on the secret it possesses, and generates a second commitment shard based on the generated random number;

[0026] The secret holding node performs a hash operation on the first commitment shard and the second commitment shard to generate a first hash value;

[0027] The secret holding node generates a third commitment shard based on the random number, the first hash value and the secret;

[0028] The secret holding node generates a secret commitment based on the first commitment shard, the second commitment shard, the first hash value, and the third commitment shard, and uploads the secret commitment to the blockchain.

[0029] In the above technical solution, in order not to disclose the real secret owned by the secret holding node, the secret holding node will not upload the real secret it owns to the blockchain, but will perform obfuscation processing on the secret, generate a verifiable commitment (i.e., secret commitment) and upload it to the blockchain. The secret verification node verifies whether the secret commitment is successful to determine whether the secret holding node corresponding to the secret commitment really owns the secret (i.e., whether it is the legal owner of the secret). Specifically, when the secret holding node detects a secret commitment generation request submitted by a user, the secret commitment generation request contains a secret identifier (i.e., which secret is specifically generated for the corresponding secret commitment), then the secret holding node can obtain the secret corresponding to the secret identifier from the secret database, and generate a first commitment fragment based on the secret, and generate a second commitment fragment based on the random number generated by itself. Moreover, in order to ensure the credibility of the secret commitment, a hash operation will be performed on the first commitment fragment and the second commitment fragment to generate a first hash value that cannot be predicted by anyone. Then, in order to realize that the generated secret commitment is a self-verifiable commitment (that is, the secret verification node can directly verify the secret commitment by itself after obtaining the secret commitment from the blockchain, without paying attention to whether the secret holding node is online), a third commitment shard is generated based on the random number, the first hash value and the secret, so as to form a self-verifiable commitment (that is, a secret commitment) together with the first commitment shard, the second commitment shard and the first hash value. Finally, the self-verifiable commitment and the identifier of the verifiable commitment are uploaded to the blockchain. On the one hand, it can ensure that the secret commitment is a commitment of the original secret, and on the other hand, it can prevent the secret commitment from being replaced or falsified. At the same time, it can also avoid direct interaction between the secret holding node and the secret verification node, thereby avoiding the risk of the secret commitment being stolen or tampered with due to direct interaction of the secret commitment through the network.

[0030] Optionally, generating a first commitment shard based on the possessed secret includes:

[0031] The secret holding node generates the first commitment shard by using the secret, the generator in the finite field and the first largest prime number through a discrete logarithm algorithm;

[0032] The generating a second commitment fragment based on the generated random number includes:

[0033] The secret holding node generates a random number in a finite field;

[0034] The secret holding node generates the second commitment shard by using the random number, the generator and the first large prime number through the discrete logarithm algorithm.

[0035] In the above technical solution, in order to ensure that the secret verification node or the criminals cannot reverse the original secret through the secret commitment, the discrete logarithm algorithm is used to calculate the secret, the generator in the finite field and the first prime number to generate the first commitment shard where the secret is hidden. Since the discrete logarithm algorithm has the characteristic that the original data cannot be reversed through the calculation result (i.e., the result is irreversible), it is impossible to reverse the original secret through the first commitment shard. In addition, in order to construct the equation for subsequent verification of the secret commitment, a random number, the generator and the first prime number generated in the finite field will be generated through the discrete logarithm algorithm to generate the second commitment shard, so as to assist in the subsequent verification through the corresponding information in the secret commitment.

[0036] Optionally, generating a third commitment shard based on the random number, the first hash value, and the secret includes:

[0037] The secret holding node generates the third commitment shard using the discrete logarithm algorithm using the random number, the first hash value, the secret and the maximum prime factor of the second largest prime number; the second largest prime number is determined based on the first largest prime number.

[0038] In the above technical scheme, in order to realize that the generated secret commitment is a self-verifiable commitment (that is, the secret verification node can directly verify the secret commitment by itself after obtaining the secret commitment from the blockchain, without paying attention to whether the secret holding node is online), and at the same time to ensure that the original secret cannot be reversed through the third commitment shard, a discrete logarithm algorithm is adopted to generate a third commitment shard for assisting subsequent verification of the secret commitment through the discrete logarithm algorithm for the random number, the first hash value, the secret and the largest prime factor of the second largest prime number. Moreover, due to the characteristic of the discrete logarithm algorithm that the original data cannot be reversed through the calculation result (that is, the result is irreversible), it is also impossible to reverse the original secret through the third commitment shard.

[0039] In a third aspect, an embodiment of the present invention provides a secret commitment verification device based on blockchain, comprising:

[0040] an acquisition unit, configured to acquire the secret commitment from the blockchain when a verification request for any secret commitment is detected; the secret commitment is generated by the corresponding secret holding node based on the secret owned and uploaded to the blockchain;

[0041] The first processing unit is used to generate first verification information based on the third commitment fragment in the secret commitment, and to generate second verification information based on the first commitment fragment, the second commitment fragment and the first hash value in the secret commitment; and to compare the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

[0042] Optionally, the first processing unit is specifically configured to:

[0043] Generate the first verification information by using the third commitment shard and the generator in the finite field through a discrete logarithm algorithm;

[0044] The first processing unit is specifically configured to:

[0045] The first commitment shard, the second commitment shard, the first hash value and the first large prime number are used through the discrete logarithm algorithm to generate the second verification information.

[0046] Optionally, the first processing unit is further configured to:

[0047] Performing a hash operation on the first commitment shard and the second commitment shard to determine a second hash value;

[0048] Determine whether the first hash value is the same as the second hash value.

[0049] Optionally, the first processing unit is specifically configured to:

[0050] Determining whether the first verification information is the same as the second verification information;

[0051] If it is determined that the first verification information is the same as the second verification information, then when it is determined that the first hash value is the same as the second hash value, it is determined that the secret commitment verification is successful.

[0052] In a fourth aspect, an embodiment of the present invention provides a secret commitment generation device based on blockchain, comprising:

[0053] A generating unit, configured to generate a first commitment fragment based on a possessed secret and generate a second commitment fragment based on a generated random number when receiving a secret commitment generation request;

[0054] The second processing unit is used to perform hash operation on the first commitment shard and the second commitment shard to generate a first hash value; generate a third commitment shard based on the random number, the first hash value and the secret; generate a secret commitment according to the first commitment shard, the second commitment shard, the first hash value and the third commitment shard, and upload the secret commitment to the blockchain.

[0055] Optionally, the generating unit is specifically used for:

[0056] Generate the first commitment shard by using the secret, the generator in the finite field, and the first largest prime number through a discrete logarithm algorithm;

[0057] The generating unit is specifically used for:

[0058] Generate a random number in a finite field;

[0059] The random number, the generator and the first large prime number are used through the discrete logarithm algorithm to generate the second commitment shard.

[0060] Optionally, the second processing unit is specifically configured to:

[0061] The random number, the first hash value, the secret and the maximum prime factor of the second largest prime number are used through the discrete logarithm algorithm to generate the third commitment shard; the second largest prime number is determined based on the first largest prime number.

[0062] In a fifth aspect, an embodiment of the present invention provides a computing device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any of the blockchain-based secret commitment verification methods described in the first aspect above, or executes any of the blockchain-based secret commitment generation methods described in the second aspect above.

[0063] In a sixth aspect, an embodiment of the present invention provides a computer-readable storage medium storing a computer program executable by a computing device, wherein when the program is run on the computing device, the computing device executes any of the blockchain-based secret commitment verification methods described in the first aspect above, or executes any of the blockchain-based secret commitment generation methods described in the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0065] Figure 1 A flowchart of a method for generating a secret commitment based on blockchain provided by an embodiment of the present invention;

[0066] Figure 2 A flowchart of a secret commitment verification method based on blockchain provided by an embodiment of the present invention;

[0067] Figure 3 A schematic diagram of the structure of a secret commitment verification device based on blockchain provided by an embodiment of the present invention;

[0068] Figure 4 A schematic diagram of the structure of a secret commitment generation device based on blockchain provided by an embodiment of the present invention;

[0069] Figure 5 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0071] First, some terms involved in the embodiments of the present invention are explained below to facilitate understanding by those skilled in the art.

[0072] (1) Blockchain: A new distributed infrastructure and computing method that uses a block chain data structure to verify and store data, a distributed node consensus algorithm to generate and update data, cryptography to ensure the security of data transmission and access, and smart contracts composed of automated script codes to program and operate data.

[0073] (2) Hash algorithm: It can also be called hash algorithm or hash algorithm. It transforms input of any length into output of fixed length through hash algorithm, and ensures that different inputs will not have the same output with a high probability.

[0074] (3) Discrete logarithm: It is a logarithmic operation based on congruence operation and primitive roots.

[0075] (4) Discrete logarithm algorithm: It means that after performing exponential operation, it is easy to calculate the result by taking the modulus of a large prime number. However, it is impossible to reverse the result to get the corresponding exponent, that is, it is irreversible.

[0076] As mentioned above, some terms involved in the embodiments of the present invention are introduced. Now, the technical features involved in the embodiments of the present invention are introduced.

[0077] Figure 1 The present invention exemplarily illustrates a process of a secret commitment generation method based on blockchain provided in an embodiment of the present invention, which process can be executed by a secret commitment generation device based on blockchain.

[0078] like Figure 1 As shown in the figure, the process specifically includes:

[0079] Step 101: When receiving a secret commitment generation request, the secret holding node generates a first commitment fragment based on the secret it possesses, and generates a second commitment fragment based on the generated random number.

[0080] In an embodiment of the present invention, a secret holding node can start the generation process for a secret commitment based on detecting a generation request for a secret commitment issued by a user, that is, the secret commitment generation request contains a secret identifier (i.e., the specific secret for which the corresponding secret commitment is generated), then the secret holding node can obtain the secret corresponding to the secret identifier from the secret database, and generate a first commitment fragment based on the secret, and generate a second commitment fragment based on a random number generated by itself. Specifically, in order to ensure that the secret verification node or criminals cannot reverse the original secret through the secret commitment, a discrete logarithm algorithm is used to perform operations on the secret, the generator in the finite field, and the first largest prime number to generate a first commitment fragment with the secret hidden. Due to the characteristic of the discrete logarithm algorithm that the original data cannot be reversed through the operation result (i.e., the result is irreversible), it is impossible to reverse the original secret through the first commitment fragment. In addition, in order to construct the equation for subsequent verification of the secret commitment, the secret holding node first generates a random number in a finite field, and then uses the random number, the generator in the finite field, and the first largest prime number to generate a second commitment shard through a discrete logarithm algorithm, so as to assist in subsequent verification through the corresponding information in the secret commitment. For example, when a user needs to prove to a secret verification node that he owns a secret, but in order not to disclose the user's secret, a verifiable commitment (i.e., a secret commitment) can be generated based on the user's secret, so that the secret verification node can confirm that the user owns the secret corresponding to the secret commitment after successfully verifying the secret commitment. For example, when a user needs to purchase a commercial house or a shop, the seller of the commercial house or the shop needs to verify the user's deposit information. In this case, the bank can act as a secret holding node to generate a secret commitment corresponding to the user's deposit information. Alternatively, when a user needs to participate in an auction of an item (such as calligraphy and painting, antiques, cars or commercial houses, etc.), the auction organization needs to verify the user's asset information. In this case, the bank or a third-party trusted organization can act as a secret holding node to generate a secret commitment corresponding to the user's asset information. Of course, for some other sensitive information of the user, the user can also act as a secret holding node to generate a secret commitment corresponding to the corresponding sensitive information. The embodiments of the present invention are not limited to this.

[0081] For example, taking the example of a secret holding node (such as a bank) generating a secret commitment for a user's deposit information x, the bank generates the first commitment shard h through the discrete logarithm algorithm based on the user's deposit information x, a generator g in a finite field (for example, the bank can predetermine the generator), and a large prime number p (for example, the bank can predetermine the large prime number), that is:

[0082] h=g x modp

[0083] The bank generates a random number r in a finite field (i.e., r∈ finite field Z q ), according to the random number r, the generator g and the large prime number p, the second commitment shard a is generated by the discrete logarithm algorithm, that is:

[0084] a=g r modp

[0085] Step 102: The secret holding node performs a hash operation on the first commitment slice and the second commitment slice to generate a first hash value.

[0086] In an embodiment of the present invention, the secret holding node performs a hash operation on the first commitment shard and the second commitment shard through a preset hash algorithm to generate a first hash value. The preset hash algorithm may include message-digest algorithm 5 (MD5), SHA256 algorithm or SM3 (senior middle 3) cryptographic hash algorithm, etc., which is not limited in the embodiment of the present invention. For example, taking message-digest algorithm 5 as an example, the secret holding node (such as a bank) performs a hash operation on the first commitment shard h and the second commitment shard a through message-digest algorithm 5 to generate a first hash value e, that is:

[0087] e=hash(h,a)

[0088] It should be noted that, on the surface, the first hash value e seems to be generated by the secret holding node. For the secret holding node, since the random number r is generated by the secret holding node, it seems that it can choose any e it wants, and can deceive the secret verification node, so that the secret commitment generated by the secret holding node is unreliable for the secret verification node. However, this is not the case. Hash (h, a) can be understood as a random number generator. For the input of the first commitment shard h and the second commitment shard a, the first commitment shard h is fixed because the secret x and the generator g are fixed; and for the second commitment shard a, it is determined by the random number r selected by the secret holding node, which means that the value of hash (h, a) is determined by the random number r. Although the random number r is a random number selected by the secret holding node, that is, the secret holding node can manipulate the random number r, which means that the secret holding node can select the value of the random number r in advance (that is, the value of the second commitment shard a is also selected), so that the input (h, a) of the hash function is also determined. However, due to the reverse difficulty and uniform distribution of the hash function, the secret holding node cannot predict the value of e = hash (h, a) in advance, thus ensuring that the secret holding node is unpredictable about e. If the first hash value e is unpredictable and uniformly random, then no matter which party provides e, the effect is the same.

[0089] Step 103: The secret holding node generates a third commitment shard based on the random number, the first hash value and the secret.

[0090] In the embodiment of the present invention, in order to realize that the generated secret commitment is a self-verifiable commitment, and in order to ensure that the original secret cannot be reversed through the third commitment shard, a discrete logarithm algorithm is used to generate a third commitment shard for assisting in the subsequent verification of the secret commitment by using the random number, the first hash value, the secret, and the largest prime factor of the second largest prime number through the discrete logarithm algorithm, and because the discrete logarithm algorithm has the characteristic that the original data cannot be reversed through the calculation result (i.e., the result is irreversible), it is also impossible to reverse the original secret through the third commitment shard. Among them, the second largest prime number is determined based on the first largest prime number. For example, if the first largest prime number is p, then the second largest prime number is p-1, and the largest prime factor of the second largest prime number is the largest prime factor of p-1.

[0091] For example, taking the bank as the secret holding node, the bank can generate the third commitment shard s by using the discrete logarithm algorithm based on the random number r generated by itself, the first hash value e, the user's deposit information x, and the maximum prime factor q of p-1, that is:

[0092] s=r+exmodq

[0093] Step 104: The secret holding node generates a secret commitment based on the first commitment shard, the second commitment shard, the first hash value, and the third commitment shard, and uploads the secret commitment to the blockchain.

[0094] In the embodiment of the present invention, after the secret holding node generates the first commitment shard, the second commitment shard, the first hash value and the third commitment shard, it can generate a secret commitment that can be verified by the secret verification node by itself by combining the first commitment shard, the second commitment shard, the first hash value and the third commitment shard, so that when the secret verification node verifies the secret commitment, it can directly verify the secret commitment by itself after obtaining the secret commitment from the blockchain, without paying attention to whether the secret holding node is online. At the same time, the secret holding node will upload the generated secret commitment to the blockchain, so that it can not only prevent the secret commitment from being replaced or forged, but also avoid the risk of the secret commitment being stolen or tampered with due to the secret verification node and the secret holding node directly interacting with each other through the network.

[0095] Exemplarily, continuing with the example of the above-mentioned secret holding node being a bank, the bank combines the first commitment shard h, the second commitment shard a, the first hash value e, and the third commitment shard s to generate a secret commitment C that the secret verification node can verify by itself, that is, C = (h, a, e, s), and uploads the secret commitment C to the blockchain, so that the secret verification node that needs to verify the secret commitment C (such as a financial institution or auction organization, etc.) can obtain the secret commitment C through the blockchain.

[0096] Accordingly, Figure 2 The present invention exemplarily illustrates a process of a secret commitment verification method based on blockchain provided by an embodiment of the present invention, which process can be executed by a secret commitment verification device based on blockchain.

[0097] like Figure 2 As shown in the figure, the process specifically includes:

[0098] Step 201: When a secret verification node detects a verification request for any secret commitment, it obtains the secret commitment from the blockchain.

[0099] In an embodiment of the present invention, a secret verification node can start a verification process for a secret commitment based on detecting a verification request for a secret commitment issued by a user, that is, the verification request contains an identifier of the secret commitment, and when a verification request for a secret commitment from a user is detected, the corresponding secret commitment can be obtained from the blockchain through the identifier of the secret commitment. Among them, the secret commitment is generated by the corresponding secret holding node based on the secret it owns and uploaded to the blockchain. Among them, the secret verification node can be an enterprise (such as a financial enterprise or financial institution, etc.) that needs to verify the identity of the corresponding user or a business place that needs to verify the identity of the corresponding user (for example, it is necessary to verify whether the age of the customer entering the business place meets the relevant regulations), or it can be an enterprise (such as a financial enterprise or financial institution, etc.) or an auction organization that needs to verify the asset information of the corresponding user. However, in order not to disclose the real secrets held by the secret holding node, the secret holding node will not upload the real secrets it holds to the blockchain, but will obfuscate the secrets and generate a verifiable commitment (i.e., secret commitment) and upload it to the blockchain. Then, the secret verification node verifies the authenticity of the secret commitment provided by the secret holding node, thereby determining whether the secret holding node corresponding to the secret commitment really owns the secret (i.e., whether it is the legal owner of the secret). For example, taking a certain auction organization as an example, the auction organization needs to verify the financial capacity of each bidder participating in the auction, that is, to verify whether the funds held by each bidder meet the auction requirements. At this time, each bidder can generate a secret commitment corresponding to the funds he owns in advance, or can entrust the corresponding banking institution to generate a secret commitment corresponding to the funds he owns. For each bidder, when the auction organization needs to verify the bidder's secret commitment, it can obtain the corresponding secret commitment from the blockchain through the secret commitment identifier generated by the bidder (the secret commitment identifier can be generated based on the bidder's ID number, or can be an identifier generated by an identifier generation method to uniquely identify the bidder). The secret commitment identifier corresponds to the secret commitment one by one.

[0100] Step 202: The secret verification node generates first verification information based on the third commitment slice in the secret commitment, and generates second verification information based on the first commitment slice, the second commitment slice and the first hash value in the secret commitment.

[0101] In the embodiment of the present invention, when a secret verification node needs to verify a secret commitment provided by a secret holding node, it only needs to directly obtain the secret commitment from the blockchain for self-verification, without paying attention to whether the secret holding node is online. Specifically, the secret verification node generates the first verification information through the discrete logarithm algorithm based on the generator in the finite field (that is, when using the discrete logarithm algorithm, a generator is determined in advance from the finite field to perform related operations of the discrete logarithm algorithm later) and the third commitment fragment in the secret commitment. In addition, the first commitment fragment, the second commitment fragment, the first hash value and the first large prime number can be used to generate the second verification information through the discrete logarithm algorithm. Then, the verification of the secret commitment can be completed through the first verification information and the second verification information, thereby determining whether the secret commitment is true and correct.

[0102] For example, for a secret verification node, when it needs to verify a secret commitment of a certain user, the secret verification node can obtain the secret commitment of the user from the blockchain through the identifier used to identify the secret commitment of the user, that is, the secret commitment C = (h, a, e, s), and the secret verification node can also obtain the first largest prime number p, a generator g in a finite field, and the largest prime factor q of the second largest prime number p-1 used to assist in verifying the secret commitment. Among them, h is used to represent the first commitment shard, a is used to represent the second commitment shard, e is used to represent the first hash value, and s is used to represent the third commitment shard; the first largest prime number p, a generator g in a finite field, and the largest prime factor q of the second largest prime number p-1 are public and can be queried from the blockchain (generally, the secret holding node can upload the first largest prime number, the largest prime factor of the second largest prime number in a generator in a finite field to the blockchain for public disclosure), or can be queried from the website provided by the secret holding node. Of course, after the secret verification node has this information, it cannot calculate the original secret corresponding to the secret commitment based on this information, but it can verify the secret commitment through this information. That is, the secret verification node generates the first verification information, namely g, according to the third commitment shard and a generator g in the finite field. s At the same time, the second verification information is generated according to the first commitment fragment h, the second commitment fragment a and the first hash value e, that is, a×h e modp.

[0103] Step 203: The secret verification node compares the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

[0104] In the embodiment of the present invention, after the secret verification node generates the first verification information and the second verification information respectively, it can compare the first verification information with the second verification information, that is, determine whether the first verification information and the second verification information are the same, so as to complete the preliminary verification of the secret commitment. s And the second verification information a×h e After modp, the initial verification of the secret commitment can be completed in the following way. That is:

[0105] g s Is it equal to a×h e modp

[0106] Among them, since r,e∈ finite field Z q , and q is the largest prime factor of p-1, so the specific process of verifying the secret commitment based on Fermat's Little Theorem is as follows:

[0107] g s =g r+exmodq =g r+ex modp

[0108] Among them, x is the original secret corresponding to the secret commitment.

[0109] And, because:

[0110]

[0111] Therefore, we only need to verify g s =a×h e modp is established, but currently through the first verification information g s And the second verification information a×h eThe verification by modp can only mean that the secret holding node may hold the secret corresponding to the secret commitment C = (h, a, e, s). The reason why it is possible to hold is that the secret holding node may tamper with the first hash value in the secret commitment. For example, for the secret holding node, the secret holding node may tamper with the value of e when uploading the secret commitment to the blockchain for storage, thereby ensuring that the above equation holds. In other words, the secret holding node attempts to make the verification of the first verification information and the second verification information successful by tampering with the first hash value. Therefore, after the initial verification of the secret commitment is successful through the first verification information and the second verification information, that is, after determining that the first verification information is the same as the second verification information, in order to further verify the authenticity and correctness of the secret commitment, it is necessary to further verify the first hash value in the secret commitment, that is, to determine whether the first hash value has been tampered with by verifying the correctness of the first hash value, so as to determine whether the secret commitment is truly authentic and credible. Specifically, by performing a hash operation on the first commitment slice and the second commitment slice in the secret commitment, a second hash value is determined, and the first hash value is compared with the second hash value to determine whether the first hash value and the second hash value are the same, so as to further accurately determine whether the secret commitment is authentic and reliable. In this way, only when it is determined that the first verification information is the same as the second verification information and the first hash value is the same as the second hash value, can it be determined that the secret commitment verification is successful, so that it can be determined that the secret commitment is authentic and reliable. Exemplarily, the secret verification node generates a second hash value e′=hash(h,a) for the first commitment slice h and the second commitment slice a through a preset hash algorithm. Then, it is determined whether the second hash value e′ is the same as the first hash value e, so as to further determine whether the secret commitment is authentic and reliable.

[0112] The above embodiments show that the technical solution of the present invention does not need to send a challenge (i.e., a random number generated and sent to the secret holding node corresponding to the secret commitment) to the secret verification node when the secret verification node needs to verify a secret commitment. Instead, the secret commitment can be directly obtained from the blockchain for self-verification, so there is no need to rely on whether the secret holding node is online. In other words, whether the secret holding node is online or not, the secret verification node can verify the secret commitment, which can effectively improve the verification efficiency of the secret commitment. Specifically, when the secret verification node detects a verification request for any secret commitment, it can directly obtain the secret commitment from the blockchain without sending a challenge to the secret holding node before obtaining the secret commitment, and without the secret holding node being online, and parses the secret commitment to obtain the first commitment fragment, the second commitment fragment, the third commitment fragment and the first hash value in the secret commitment, so that the secret verification node can verify the secret commitment based on the third commitment fragment. The first verification information is generated based on the first commitment slice, the second commitment slice and the first hash value. Then, the first verification information is compared with the second verification information to determine whether the secret commitment is successfully verified. In this way, when verifying the secret commitment generated by the secret holding node, the scheme can directly obtain the secret commitment from the blockchain regardless of whether the secret holding node is online, and there is no need to send a challenge to the secret holding node before obtaining the secret commitment (that is, the secret verification node generates a random number and sends it to the secret holding node corresponding to the secret commitment, so that the secret holding node can assist the secret verification node to complete the verification of the secret commitment). In this way, the time spent on interacting with the challenge can be effectively reduced, thereby effectively improving the verification efficiency of the secret commitment and improving the user experience. In addition, since the scheme does not interact with the random number in the process of verifying the secret commitment, it can effectively reduce the network overhead and prevent the attacker from stealing or tampering with the random number, thereby effectively improving the security of verifying the secret commitment.

[0113] Based on the same technical concept, Figure 3 A blockchain-based secret commitment verification device provided by an embodiment of the present invention is exemplarily shown, and the device can execute the process of a blockchain-based secret commitment verification method.

[0114] like Figure 3 As shown, the device comprises:

[0115] The acquisition unit 301 is used to acquire the secret commitment from the blockchain when a verification request for any secret commitment is detected; the secret commitment is generated by the corresponding secret holding node based on the secret owned and uploaded to the blockchain;

[0116] The first processing unit 302 is used to generate first verification information based on the third commitment fragment in the secret commitment, and to generate second verification information based on the first commitment fragment, the second commitment fragment and the first hash value in the secret commitment; and to compare the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

[0117] Optionally, the first processing unit 302 is specifically configured to:

[0118] Generate the first verification information by using the third commitment shard and the generator in the finite field through a discrete logarithm algorithm;

[0119] The first processing unit 302 is specifically configured to:

[0120] The first commitment shard, the second commitment shard, the first hash value and the first large prime number are used through the discrete logarithm algorithm to generate the second verification information.

[0121] Optionally, the first processing unit 302 is further configured to:

[0122] Performing a hash operation on the first commitment shard and the second commitment shard to determine a second hash value;

[0123] Determine whether the first hash value is the same as the second hash value.

[0124] Optionally, the first processing unit 302 is specifically configured to:

[0125] Determining whether the first verification information is the same as the second verification information;

[0126] If it is determined that the first verification information is the same as the second verification information, then when it is determined that the first hash value is the same as the second hash value, it is determined that the secret commitment verification is successful.

[0127] Based on the same technical concept, Figure 4 A blockchain-based secret commitment generation device provided by an embodiment of the present invention is exemplarily shown, and the device can execute the process of a blockchain-based secret commitment generation method.

[0128] like Figure 4 As shown, the device comprises:

[0129] The generating unit 401 is used to generate a first commitment fragment based on the possessed secret and generate a second commitment fragment based on the generated random number when receiving a secret commitment generation request;

[0130] The second processing unit 402 is used to perform hash operation on the first commitment shard and the second commitment shard to generate a first hash value; generate a third commitment shard based on the random number, the first hash value and the secret; generate a secret commitment according to the first commitment shard, the second commitment shard, the first hash value and the third commitment shard, and upload the secret commitment to the blockchain.

[0131] Optionally, the generating unit 401 is specifically configured to:

[0132] Generate the first commitment shard by using the secret, the generator in the finite field, and the first largest prime number through a discrete logarithm algorithm;

[0133] The generating unit 401 is specifically used for:

[0134] Generate a random number in a finite field;

[0135] The random number, the generator and the first large prime number are used through the discrete logarithm algorithm to generate the second commitment shard.

[0136] Optionally, the second processing unit 402 is specifically configured to:

[0137] The random number, the first hash value, the secret and the maximum prime factor of the second largest prime number are used through the discrete logarithm algorithm to generate the third commitment shard; the second largest prime number is determined based on the first largest prime number.

[0138] Based on the same technical concept, the embodiment of the present invention also provides a computing device, such as Figure 5 As shown, it includes at least one processor 501 and a memory 502 connected to the at least one processor. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present invention. Figure 5 For example, the processor 501 and the memory 502 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0139] In an embodiment of the present invention, the memory 502 stores instructions that can be executed by at least one processor 501. By executing the instructions stored in the memory 502, the at least one processor 501 can execute the steps included in the aforementioned blockchain-based secret commitment generation method or blockchain-based secret commitment verification method.

[0140] Among them, the processor 501 is the control center of the computing device, and can use various interfaces and lines to connect various parts of the computing device, and realize data processing by running or executing instructions stored in the memory 502 and calling data stored in the memory 502. Optionally, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0141] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the secret commitment generation method based on blockchain or the secret commitment verification method based on blockchain may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0142] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0143] Based on the same technical concept, an embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program that can be executed by a computing device. When the program runs on the computing device, the computing device executes the steps of the above-mentioned blockchain-based secret commitment generation method or blockchain-based secret commitment verification method.

[0144] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0146] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0148] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0149] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A secret commitment verification method based on blockchain, characterized in that: include: When a secret verification node detects a verification request for any secret commitment, it obtains the secret commitment from the blockchain; the secret commitment is generated by the corresponding secret holding node according to the first commitment shard, the second commitment shard, the first hash value and the third commitment shard and uploaded to the blockchain when receiving a secret commitment generation request, wherein the first commitment shard is generated by the secret holding node through a discrete logarithm algorithm based on a secret owned by the secret holding node, a generator in a finite field and a first large prime number, the second commitment shard is generated by the secret holding node based on a generated random number, the first hash value is generated by the secret holding node performing a hash operation on the first commitment shard and the second commitment shard, and the third commitment shard is generated by the secret holding node based on the random number, the first hash value and the secret; The secret verification node generates first verification information based on the third commitment slice, and generates second verification information based on the first commitment slice, the second commitment slice and the first hash value; The secret verification node compares the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

2. The method according to claim 1, characterized in that The generating first verification information based on the third commitment slice includes: The secret verification node generates the first verification information by using a discrete logarithm algorithm for the third commitment shard and the generator in the finite field; The generating second verification information based on the first commitment slice, the second commitment slice and the first hash value includes: The secret verification node generates the second verification information by using the discrete logarithm algorithm with the first commitment shard, the second commitment shard, the first hash value and the first large prime number.

3. The method according to claim 1, characterized in that Before determining whether the secret commitment is successfully verified, the method further includes: The secret verification node performs a hash operation on the first commitment slice and the second commitment slice to determine a second hash value; The secret verification node determines whether the first hash value is the same as the second hash value.

4. The method according to claim 3, characterized in that Comparing the first verification information with the second verification information to determine whether the secret commitment is successfully verified includes: The secret verification node determines whether the first verification information is the same as the second verification information; If the secret verification node determines that the first verification information is the same as the second verification information, then when it is determined that the first hash value is the same as the second hash value, it is determined that the secret commitment verification is successful.

5. A method for generating a secret commitment based on blockchain, characterized in that: include: When receiving a secret commitment generation request, the secret holding node generates a first commitment shard based on the secret it possesses, and generates a second commitment shard based on a random number generated by the secret holding node; wherein generating the first commitment shard based on the secret it possesses comprises: the secret holding node generates the first commitment shard using a discrete logarithm algorithm using the secret, a generator in a finite field, and a first large prime number; The secret holding node performs a hash operation on the first commitment shard and the second commitment shard to generate a first hash value; The secret holding node generates a third commitment shard based on the random number, the first hash value and the secret; The secret holding node generates a secret commitment based on the first commitment shard, the second commitment shard, the first hash value, and the third commitment shard, and uploads the secret commitment to the blockchain.

6. The method according to claim 5, characterized in that The generating a second commitment shard based on the random number generated by the secret holding node comprises: The secret holding node generates a random number in a finite field; The secret holding node generates the second commitment shard by using the random number, the generator and the first large prime number through the discrete logarithm algorithm.

7. The method according to claim 5, characterized in that The generating a third commitment shard based on the random number, the first hash value, and the secret includes: The secret holding node generates the third commitment shard using a discrete logarithm algorithm using the random number, the first hash value, the secret and the largest prime factor of the second largest prime number; the second largest prime number is determined based on the first largest prime number.

8. A secret commitment verification device based on blockchain, characterized in that: include: an acquisition unit, configured to acquire the secret commitment from the blockchain when a verification request for any secret commitment is detected; the secret commitment is generated by the corresponding secret holding node according to the first commitment shard, the second commitment shard, the first hash value and the third commitment shard and uploaded to the blockchain when receiving the secret commitment generation request, wherein the first commitment shard is generated by the secret holding node through a discrete logarithm algorithm based on a secret owned by the secret holding node, a generator in a finite field and a first large prime number, the second commitment shard is generated by the secret holding node based on a generated random number, the first hash value is generated by the secret holding node performing a hash operation on the first commitment shard and the second commitment shard, and the third commitment shard is generated by the secret holding node based on the random number, the first hash value and the secret; The first processing unit is used to generate first verification information based on the third commitment shard, and generate second verification information based on the first commitment shard, the second commitment shard and the first hash value; compare the first verification information with the second verification information to determine whether the secret commitment is successfully verified.

9. A secret commitment generation device based on blockchain, characterized in that: include: A generating unit, configured to generate a first commitment shard based on the possessed secret and generate a second commitment shard based on the generated random number when receiving a secret commitment generation request; wherein, when the generating unit generates the first commitment shard based on the possessed secret, the generating unit is specifically configured to: generate the first commitment shard by using a discrete logarithm algorithm using the secret, a generator in a finite field, and a first large prime number; The second processing unit is used to perform hash operation on the first commitment shard and the second commitment shard to generate a first hash value; generate a third commitment shard based on the random number, the first hash value and the secret; generate a secret commitment according to the first commitment shard, the second commitment shard, the first hash value and the third commitment shard, and upload the secret commitment to the blockchain.

10. A computing device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computing device, and when the program is run on the computing device, the computing device executes the method according to any one of claims 1 to 7.

Images